by Kastro
Paper/Archive/CVE-2022-1668

CVE-2022-1668

Secheron SEPCOS Control and Protection Relay firmware package — Secheron SEPCOS Control and Protection Relay

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.0.830 × 2016.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.

Affected

ProductAffectedFixed inSource
SEPCOS Control and Protection Relay firmware packageAll versions – < 1.23.211.23.21CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-174-03