Default credentials

2022-06-2415:15:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely available open-source tool.

CPENameOperatorVersion
sepcos_control_and_protection_relay_firmwarege1.23.0
sepcos_control_and_protection_relay_firmwarelt1.23.21
sepcos_control_and_protection_relay_firmwarege1.24.0
sepcos_control_and_protection_relay_firmwarelt1.24.8
sepcos_control_and_protection_relay_firmwarege1.25.0
sepcos_control_and_protection_relay_firmwarelt1.25.3

Name	Operator	Version
sepcos_control_and_protection_relay_firmware	ge	1.23.0
sepcos_control_and_protection_relay_firmware	lt	1.23.21
sepcos_control_and_protection_relay_firmware	ge	1.24.0
sepcos_control_and_protection_relay_firmware	lt	1.24.8
sepcos_control_and_protection_relay_firmware	ge	1.25.0
sepcos_control_and_protection_relay_firmware	lt	1.25.3

References

www.cisa.gov/uscert/ics/advisories/icsa-22-174-03