PatchTheCVECVE-2022-1666: The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 h
CVE-2022-1666 is a medium-severity flaw (CVSS 6.5) affecting sepcos control and protection relay firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely available open-source tool.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 43%) |
| CISA exploited list | No |
| Weakness | CWE-522 |
| Published | 2022-06-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-1666?
sepcos control and protection relay firmware: upgrade to 1.23.21, 1.24.8, 1.25.3. Exact commands for each OS are on this page.
Is CVE-2022-1666 being exploited?
CVE-2022-1666 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-1666 affect?
CVE-2022-1666 affects sepcos control and protection relay firmware. Severity is medium (CVSS 6.5). The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely available open-source tool.
How urgent is CVE-2022-1666?
Priority 37/100. No elevated risk signals yet.
Related CVEs
- CVE-2022-2105 CRITICAL 9.4 UPGRADE Client-side JavaScript controls may be bypassed to change user credentials and permissions without authenticat
- CVE-2022-2104 CRITICAL 9.9 UPGRADE The www-data (Apache web server) account is configured to run sudo with no password for many commands (includi
- CVE-2022-2103 CRITICAL 9.8 UPGRADE An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read
- CVE-2022-2102 CRITICAL 9.4 UPGRADE Controls limiting uploads to certain file extensions may be bypassed
- CVE-2022-1668 CRITICAL 9.8 UPGRADE Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the op