Authentication flaw

2022-06-2415:15:00

PRIOn knowledge base

www.prio-n.com

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.5%

JSON

Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.

CPENameOperatorVersion
sepcos_control_and_protection_relay_firmwarege1.23.0
sepcos_control_and_protection_relay_firmwarelt1.23.21
sepcos_control_and_protection_relay_firmwarege1.24.0
sepcos_control_and_protection_relay_firmwarelt1.24.8
sepcos_control_and_protection_relay_firmwarege1.25.0
sepcos_control_and_protection_relay_firmwarelt1.25.3

Name	Operator	Version
sepcos_control_and_protection_relay_firmware	ge	1.23.0
sepcos_control_and_protection_relay_firmware	lt	1.23.21
sepcos_control_and_protection_relay_firmware	ge	1.24.0
sepcos_control_and_protection_relay_firmware	lt	1.24.8
sepcos_control_and_protection_relay_firmware	ge	1.25.0
sepcos_control_and_protection_relay_firmware	lt	1.25.3

References

www.cisa.gov/uscert/ics/advisories/icsa-22-174-03