Security readout for executives and security teams
Plain-English summary
This CVE concerns specific Nautilus T616 and T618 treadmill serial ranges that may unexpectedly start when connected to 120V power, creating a fall hazard. It is a physical safety issue, not a network compromise. Business urgency is highest for gyms, hotels, clinics, residences, or inventory handlers with affected units.
Executive priority
Treat as a targeted physical safety recall issue. Prioritize facilities where affected treadmills are accessible to staff, customers, patients, or residents. It is low cyber risk but may create safety, operations, and liability exposure if ignored.
Technical view
CVE-2022-35648 affects Nautilus T616 and T618 treadmills in listed serial ranges running software before 2022-06-09. A physically proximate attacker or unsafe power-restoration condition can cause denial of service through unintended treadmill movement. CVSS 3.1 is 2.6, with physical attack vector and no confidentiality or integrity impact.
Likely exposure
Exposure is limited to organizations or individuals possessing the affected Nautilus T616 or T618 serial ranges with pre-2022-06-09 software. Network-facing systems are not implicated by the provided sources.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not in KEV. Risk depends on physical proximity and access to an affected treadmill. The practical concern is bodily injury from unexpected operation, not data theft or system compromise.
Researcher notes
The CVE record provides serial ranges, software cutoff, CVSS vector, and physical denial-of-service framing. Sources do not provide broader affected products, exploit reports, or detailed technical root cause. Avoid extrapolating beyond the named Nautilus models and serial ranges.
Mitigation direction
- Check Nautilus and CPSC guidance for the official remedy.
- Identify affected T616 and T618 units by serial number.
- Update affected treadmill software to 2022-06-09 or later when vendor-supported.
- Restrict use of affected units until remedy status is confirmed.
Validation and detection
- Inventory Nautilus T616 and T618 treadmills across all sites.
- Compare serial numbers against the CVE-listed affected ranges.
- Confirm installed software date or version is not before 2022-06-09.
- Retain evidence of vendor notice review and remediation completion.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-35648 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AC:L/AV:P/A:L/C:N/I:N/PR:N/S:C/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AC:L/AV:P/A:L/C:N/I:N/PR:N/S:C/UI:N0.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
2.6LowVector: CVSS:3.1/AC:L/AV:P/A:L/C:N/I:N/PR:N/S:C/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://download.nautilus.com/pdf/NLS.T616-T618.cpsc.safety.notice.EN.pdfCVE reference · x_refsource_MISC
- https://www.cpsc.gov/Recalls/2022/Nautilus-Recalls-Treadmills-Due-to-Fall-HazardCVE reference · x_refsource_MISC
- https://cwe.mitre.org/data/definitions/372.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.