CVE-2022-22809 in spaceLYnk
Summary
by MITRE • 02/10/2022
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/29/2026
The vulnerability identified as CVE-2022-22809 represents a critical authentication flaw classified under CWE-306, which specifically addresses missing authentication for critical functions within software systems. This weakness manifests in several IoT and smart home products including spaceLYnk V2.6.2 and prior versions, Wiser for KNX (formerly homeLYnk) V2.6.2 and prior versions, and fellerLYnk V2.6.2 and prior versions. The affected systems operate within the connected home and building automation space where touch configuration modifications are critical system functions that require proper authorization and authentication mechanisms.
The technical flaw stems from the absence of proper authentication checks when users attempt to modify touch configurations within these systems. Touch configuration modifications typically involve altering user interface layouts, button mappings, or interaction patterns that directly affect system functionality and user experience. Without proper authentication mechanisms, any attacker with network access to these systems can perform unauthorized modifications to touch configurations, potentially leading to system misconfiguration or complete operational disruption. This vulnerability creates a pathway for attackers to manipulate how users interact with the system interfaces, which can have cascading effects on overall system security and functionality.
The operational impact of this vulnerability extends beyond simple configuration changes and represents a significant threat to system integrity and user safety. Attackers could potentially reconfigure touch interfaces to redirect users to malicious endpoints, disable critical functions, or create confusing user experiences that might mask more serious underlying attacks. In the context of building automation systems, unauthorized touch configuration modifications could affect critical functions such as lighting controls, climate management, or security system interfaces, potentially compromising building safety and operational efficiency. The vulnerability particularly affects systems where touch interfaces serve as primary means of user interaction with complex automation functions.
From a cybersecurity perspective, this vulnerability aligns with ATT&CK technique T1547.001 which covers Registry Run Keys / Startup Folder, and T1068 which involves Exploitation for Privilege Escalation. The missing authentication mechanism essentially provides an attack surface that allows lateral movement and privilege escalation within the affected systems. Organizations should implement immediate mitigations including enforcing strong authentication mechanisms for all critical system functions, implementing network segmentation to limit access to these systems, and conducting thorough security audits of all touch interface configurations. Additionally, the vulnerability highlights the importance of secure development practices and proper authentication implementation as outlined in OWASP Top Ten and NIST Cybersecurity Framework guidelines.
The remediation approach should involve updating all affected versions to patched releases that implement proper authentication checks for touch configuration modifications, along with implementing network-based access controls and monitoring for unauthorized configuration changes. Security professionals should also consider conducting penetration testing to verify that authentication mechanisms are properly implemented and that no other similar vulnerabilities exist within the affected product lines. The vulnerability serves as a reminder of the critical importance of authentication in IoT systems and the potential consequences of failing to implement proper access controls for critical functions.