CVE-2022-2105
mediumPriorität · verfolgen · 36EPSS 0.011 · 66. PerzentilEURUUSEPSS · bewertet 2026-10-26
Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSEPCOS Single Package firmware (1.23.xx feature level)cisa_csaf_ot
SEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version
- BehobenSEPCOS Single Package firmware (1.24.xx feature level)cisa_csaf_ot
SEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version
- BehobenSEPCOS Single Package firmware (1.25.xx feature level)cisa_csaf_ot
SEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version
- MitigationSEPCOS Single Package firmware (1.23.xx feature level)cisa_csaf_ot
Check device logs during periodic maintenance for unauthorized changes or access.
- MitigationSEPCOS Single Package firmware (1.24.xx feature level)cisa_csaf_ot
Check device logs during periodic maintenance for unauthorized changes or access.
- MitigationSEPCOS Single Package firmware (1.25.xx feature level)cisa_csaf_ot
Check device logs during periodic maintenance for unauthorized changes or access.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.4–9.4
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (13)
Betroffene Produkte und Versionsbereiche.
- secheron sepcos control and protection relay firmware1.23.0 → 1.23.21nvdUScpe:2.3:o:secheron:sepcos_control_and_protection_relay_firmware:*:*:*:*:*:*:*:*
- secheron sepcos control and protection relay firmware1.24.0 → 1.24.8nvdUScpe:2.3:o:secheron:sepcos_control_and_protection_relay_firmware:*:*:*:*:*:*:*:*
- secheron sepcos control and protection relay firmware1.25.0 → 1.25.3nvdUScpe:2.3:o:secheron:sepcos_control_and_protection_relay_firmware:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-22-174-03Secheron SEPCOS Control and Protection Relay2022-06-23icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to obtain full, root access over the device in multiple ways. Initial footholds through S-Web interface software vulnerabilities could allow an attacker to obtain a level of control over the PLC's functions only the vendor typically has access to. This includes the ability to reset the PLC, upload arbitrary files / execute code, and change parameters for protective functions that can pose a range of availability and safety risks to the power system the PLC is configured to control (based on the specific implementation). Further exploitation of the underlying PLC misconfigurations can allow an attacker to trivially escalate privileges to OS root through either the S-Web vulnerabilities or FTP and SSH misconfigurations.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2022-2105/cnnvd
- https://support.secheron.com/Patchcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-22-174-03cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.3073cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03enisa_euvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03MitigationThird Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan