PatchTheCVECVE-2022-1668: Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the op
CVE-2022-1668 is a critical-severity flaw (CVSS 9.8) affecting sepcos control and protection relay firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.3% (top 17%) |
| CISA exploited list | No |
| Weakness | CWE-521 |
| Published | 2022-06-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-1668?
sepcos control and protection relay firmware: upgrade to 1.23.21, 1.24.8, 1.25.3. Exact commands for each OS are on this page.
Is CVE-2022-1668 being exploited?
CVE-2022-1668 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-1668 affect?
CVE-2022-1668 affects sepcos control and protection relay firmware. Severity is critical (CVSS 9.8). Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
How urgent is CVE-2022-1668?
Priority 60/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2022-2105 CRITICAL 9.4 UPGRADE Client-side JavaScript controls may be bypassed to change user credentials and permissions without authenticat
- CVE-2022-2104 CRITICAL 9.9 UPGRADE The www-data (Apache web server) account is configured to run sudo with no password for many commands (includi
- CVE-2022-2103 CRITICAL 9.8 UPGRADE An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read
- CVE-2022-2102 CRITICAL 9.4 UPGRADE Controls limiting uploads to certain file extensions may be bypassed
- CVE-2022-1667 HIGH 7.5 UPGRADE Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., fro