An access control issue in Trimble TM4Web version 22.2.0 allows unauthenticated malicious users to access a specific crafted URL path to retrieve the last registration access code and use this access code to register a valid account. If the access code was used to create an Administrator account, attackers are also able to register new Administrator accounts with full rights and privileges.
Vulmon