by Kastro
Paper/Archive/CVE-2022-2105

CVE-2022-2105

Secheron SEPCOS Control and Protection Relay firmware package — Secheron SEPCOS Control and Protection Relay

EPSS 1%CVSS 9.4
critical.is priorityof 100
41
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 66.2.662 × 2013.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.

Affected

ProductAffectedFixed inSource
SEPCOS Control and Protection Relay firmware packageAll versions – < 1.23.211.23.21CNA

Scores by source

icscert (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcisa.gov/uscert/ics/advisories/icsa-22-174-03