by Kastro
Paper/Archive/CVE-2022-0902

CVE-2022-0902

ABB RMC-100 (Standard) — ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access

EPSS 17%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.1.971 × 2019.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.

Affected

ProductAffectedFixed inSource
RMC-100 (Standard)unspecified – < 2105457-0372105457-037CNA
RMC-100-LITEunspecified – < 2106229-0112106229-011CNA
XIOunspecified – < 2106198-0082106198-008CNA
XFCG5unspecified – < 2105805-0162105805-016CNA
XRCG5unspecified – < 2105864-0162105864-016CNA
uFLOG5unspecified – < 2105298-0242105298-024CNA
UDCunspecified – < 2106177-0072106177-007CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ABB (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsearch.abb.com/library/Download.aspx?DocumentID=9AKK108467A0927&LanguageCode=en&DocumentPartId=&Action=Launch&_ga