Vulnerability · Published Dec 12, 2022 · Assigned by icscert
CVE-2022-2641
Critical 9.8
In plain English
A critical-severity security flaw in Remote Compact Controller (RCC) 972 from Horner Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 51.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes to the device, remotely execute arbitrary code, or cause a denial-of-service condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Horner Automation | Remote Compact Controller (RCC) 972 | Firmware Version 15.40 |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H