PatchTheCVECVE-2022-47559: Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised req
CVE-2022-47559 is a high-severity flaw (CVSS 8.6) affecting ekorrci firmware, ekorccp firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 8.6 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 86%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2023-09-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-47559?
ekorrci firmware: mitigate or apply the listed mitigation; ekorccp firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2022-47559 being exploited?
CVE-2022-47559 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-47559 affect?
CVE-2022-47559 affects ekorrci firmware, ekorccp firmware. Severity is high (CVSS 8.6). Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.
How urgent is CVE-2022-47559?
Priority 39/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2022-47562 HIGH 7.5 MITIGATE MITIGATE Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial
- CVE-2022-47561 HIGH 7.3 MITIGATE MITIGATE The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without lo
- CVE-2022-47560 MEDIUM 5.7 MITIGATE MITIGATE The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom re
- CVE-2022-47558 CRITICAL 9.4 MITIGATE MITIGATE Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials
- CVE-2022-47557 MEDIUM 6.1 MITIGATE MITIGATE Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device