Vulnerability identifier: #VU64687
Vulnerability risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-521
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
SEPCOS Single Package
Hardware solutions /
Firmware
Vendor:
Description
The vulnerability allows an attacker to perform brute-force attack and guess the password.
The vulnerability exists due to weak password requirements. An attacker can obtain OS superuser privileges over the open TCP port for SSH.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
External links
http://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.