PatchTheCVECVE-2022-47555: Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to exec
CVE-2022-47555 is a critical-severity flaw (CVSS 9.3) affecting ekorrci firmware, ekorccp firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.3 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.1% (top 33%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2023-09-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-47555?
ekorrci firmware: mitigate or apply the listed mitigation; ekorccp firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2022-47555 being exploited?
CVE-2022-47555 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-47555 affect?
CVE-2022-47555 affects ekorrci firmware, ekorccp firmware. Severity is critical (CVSS 9.3). Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
How urgent is CVE-2022-47555?
Priority 54/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2022-47562 HIGH 7.5 MITIGATE MITIGATE Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial
- CVE-2022-47561 HIGH 7.3 MITIGATE MITIGATE The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without lo
- CVE-2022-47560 MEDIUM 5.7 MITIGATE MITIGATE The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom re
- CVE-2022-47559 HIGH 8.6 MITIGATE MITIGATE Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised req
- CVE-2022-47558 CRITICAL 9.4 MITIGATE MITIGATE Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials