CVE-2022-2640
Last modified
CVE-2022-2640 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hornerautomation | Rcc972 Firmware | 15.40 |
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02Patch, Third Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02Patch, Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2640?
How severe is CVE-2022-2640?
How do I fix CVE-2022-2640?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-26389An improper access control vulnerability may allow privilege…7.7
- CVE-2022-2639An integer coercion error was found in the openvswitch kerne…7.8
- CVE-2022-26390The Baxter Spectrum Wireless Battery Module (WBM) stores net…4.2
- CVE-2022-26392The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WB…6.5
- CVE-2022-26393The Baxter Spectrum WBM is susceptible to format string atta…8.1
- CVE-2022-26394The Baxter Spectrum WBM does not perform mutual authenticati…5.4
- CVE-2022-2641Horner Automation’s RCC 972 with firmware version 15.40 has …9.8
- CVE-2022-26413A command injection vulnerability in the CGI program of Zyxe…8
- CVE-2022-26414A potential buffer overflow vulnerability was identified in …5.5
- CVE-2022-26415On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versi…9.1
- CVE-2022-26416Rejected reason: This candidate was in a CNA pool that was n…
- CVE-2022-26417Omron CX-Position (versions 2.5.3 and prior) is vulnerable t…7.8
Are you affected by CVE-2022-2640?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST