Horner Automation Remote Compact Controller
view advisory published 2022-12-01
Successful exploitation of these vulnerabilities could allow an attacker to obtain credentials to the affected device and obtain complete control.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-2642US | high7.5 | — | ||
Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and variable keys from the device. | ||||
| CVE-2022-2641US | critical9.8OT elevated | — | ||
Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remot… | ||||
| CVE-2022-2640US | high7.5 | — | ||
The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker t… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-22-335-02 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (3)
- MitigationRCC 972
RCC 972: Update to Firmware Version 15.60 or later
https://hornerautomation.com/controller-firmware-cscan/ - MitigationRCC 972
RCC 972: Update to Firmware Version 15.60 or later
https://hornerautomation.com/controller-firmware-cscan/ - MitigationRCC 972
RCC 972: Update to Firmware Version 15.60 or later
https://hornerautomation.com/controller-firmware-cscan/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan