CVE-2022-2103

CRITICAL

SEPCO Control and Protection Relay Firmware 1.23.0-1.23.21 - Unauthenticated Sensitive File Read and RCE via FTP

Title source: llm
STIX 2.1

Description

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories.

References (1)

Core 1
Core References
Mitigation, Third Party Advisory, US Government Resource x_refsource_misc
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03

Scores

CVSS v3 9.8
EPSS 0.0086
EPSS Percentile 53.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-284 CWE-522
Status published
Products (1)
secheron/sepcos_control_and_protection_relay_firmware 1.23.0 - 1.23.21
Published Jun 24, 2022
Tracked Since Feb 18, 2026