SB2022120221 - Multiple vulnerabilities in Horner Automation Remote Compact Controller 972

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022120221

SB2022120221 - Multiple vulnerabilities in Horner Automation Remote Compact Controller 972

Published: December 2, 2022

Security Bulletin ID SB2022120221
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Inadequate Encryption Strength (CVE-ID: CVE-2022-2640)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the config-files are encrypted with weak XOR encryption. A remote attacker can obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).


2) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2022-2641)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected product has a static encryption key on the device. A remote attacker can execute arbitrary code on the target system.


3) Excessive Reliance on Global Variables (CVE-ID: CVE-2022-2642)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected device contains global variables. A remote attacker can read out sensitive values and variable keys from the device.


Remediation

Install update from vendor's website.

References