by Kastro
Paper/Archive/CVE-2022-2102

CVE-2022-2102

Secheron SEPCOS Control and Protection Relay firmware package — Secheron SEPCOS Control and Protection Relay

EPSS 0.9%CVSS 9.4
critical.is priorityof 100
40
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 61.1.611 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.

Affected

ProductAffectedFixed inSource
SEPCOS Control and Protection Relay firmware packageAll versions – < 1.23.211.23.21CNA

Scores by source

icscert (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcisa.gov/uscert/ics/advisories/icsa-22-174-03