Vulnerability · Published Jun 24, 2022 · Assigned by icscert

CVE-2022-2102Secheron SEPCOS Control and Protection Relay

Critical 9.4

In plain English

A critical-severity security flaw in SEPCOS Control and Protection Relay firmware package from Secheron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)0.9%top 38.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.

Affected products (as reported)

Vendor	Product	Versions
Secheron	SEPCOS Control and Protection Relay firmware package	All versions – before 1.23.21

Weakness: CWE-841 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03 x_refsource_MISC