9.8
CVE-2022-2103
- EPSS 0.24%
- Veröffentlicht 24.06.2022 15:15:10
- Zuletzt bearbeitet 21.11.2024 07:00:19
- Quelle ics-cert@hq.dhs.gov
- CVE-Watchlists
- Unerledigt
LoginAn attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Secheron ≫ Sepcos Control And Protection Relay Firmware Version >= 1.23.0 < 1.23.21
Secheron ≫ Sepcos Control And Protection Relay Firmware Version >= 1.24.0 < 1.24.8
Secheron ≫ Sepcos Control And Protection Relay Firmware Version >= 1.25.0 < 1.25.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.47 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.1 | 3.9 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
| nvd@nist.gov | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
| ics-cert@hq.dhs.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-522 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.