Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2022-2822: OctoPrint allows attackers to guess passwords and take over accounts
CVE-2022-2822 · published 4 years ago
Summary
The OctoPrint web interface used for 3D printers does not limit login attempts, so anyone can try many passwords until they succeed. This can let an attacker access regular or admin accounts and control the printer. Use strong, unique passwords, enable any available two‑factor authentication, and apply the latest OctoPrint updates that add login‑rate limiting.
What to do
- Update octoprint octoprint to version 1.9.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | gina häußge | octoprint | <= 1.7.3 |
| – | octoprint | octoprint |
< 1.9.0 cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:* |
Original advisory text
Authentication Bypass by Primary Weakness in octoprint/octoprint
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.
References
- https://github.com/advisories/GHSA-5w5x-q9p5-9qg3
- https://huntr.dev/bounties/6369f355-e6ef-4469-af75-0f6ff00cde3d URL
- https://nvd.nist.gov/vuln/detail/CVE-2022-2822 Vendor Advisory
- https://github.com/octoprint/octoprint/commit/82c892ba40b3741d1b7711d949e56af64f... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2822.j... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published15 Aug 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta