Lucene search

INCIBECVE-2022-47555

HistorySep 19, 2023 - 1:16 p.m.

CVE-2022-47555

2023-09-1913:16:20

CWE-78

INCIBE

web.nvd.nist.gov

cve-2022-47555

operating system

command injection

ekorccp

ekorrci

authenticated attack

user privilege escalation

backdoor

CVSS3

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

43.3%

JSON

Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

ormazabalekorrci_firmwareMatch601j

AND

ormazabalekorrciMatch-

Node

ormazabalekorccp_firmwareMatch601j

AND

ormazabalekorccpMatch-

VendorProductVersionCPE
ormazabalekorrci_firmware601jcpe:2.3:o:ormazabal:ekorrci_firmware:601j:*:*:*:*:*:*:*
ormazabalekorrci-cpe:2.3:h:ormazabal:ekorrci:-:*:*:*:*:*:*:*
ormazabalekorccp_firmware601jcpe:2.3:o:ormazabal:ekorccp_firmware:601j:*:*:*:*:*:*:*
ormazabalekorccp-cpe:2.3:h:ormazabal:ekorccp:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ormazabal	ekorrci_firmware	601j	cpe:2.3:o:ormazabal:ekorrci_firmware:601j:::::::*
ormazabal	ekorrci	-	cpe:2.3:h:ormazabal:ekorrci:-:::::::*
ormazabal	ekorccp_firmware	601j	cpe:2.3:o:ormazabal:ekorccp_firmware:601j:::::::*
ormazabal	ekorccp	-	cpe:2.3:h:ormazabal:ekorccp:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ekorCCP",
    "vendor": "Ormazabal",
    "versions": [
      {
        "status": "affected",
        "version": "601j"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "ekorRCI",
    "vendor": "Ormazabal",
    "versions": [
      {
        "status": "affected",
        "version": "601j"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products

CVSS3

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

43.3%

JSON

Related for CVE-2022-47555