sepcos control and protection relay firmware vulnerabilities and fixes

Recent CVEs affecting sepcos control and protection relay firmware, with upgrade or downgrade steps. 7 tracked.

Also searched as: sepcoscontrolandprotectionrelayfirmware.

sepcos control and protection relay firmware has 7 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 7. Most recent: 2022-06-24. Highest priority: CVE-2022-1668 (score 60/100).

• CVE-2022-2105 CRITICAL 9.4 UPGRADE Client-side JavaScript controls may be bypassed to change user credentials and permissions without authenticat
• CVE-2022-2104 CRITICAL 9.9 UPGRADE The www-data (Apache web server) account is configured to run sudo with no password for many commands (includi
• CVE-2022-2103 CRITICAL 9.8 UPGRADE An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read
• CVE-2022-2102 CRITICAL 9.4 UPGRADE Controls limiting uploads to certain file extensions may be bypassed
• CVE-2022-1668 CRITICAL 9.8 UPGRADE Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the op
• CVE-2022-1667 HIGH 7.5 UPGRADE Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., fro
• CVE-2022-1666 MEDIUM 6.5 UPGRADE The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 h

FAQ

How do I fix sepcos control and protection relay firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is sepcos control and protection relay firmware being exploited right now?

None of the tracked sepcos control and protection relay firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which sepcos control and protection relay firmware CVE should I patch first?

CVE-2022-1668 currently ranks highest (60/100): Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the op.

RSS feed for sepcos control and protection relay firmware · ← Back to latest CVEs