CRITICAL🇵🇱 Wersja polska

CVE-2022-2102

CVSS 9.4v3.1pub. 2022-06-24upd. 2024-11-21

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

  • Secheron Sepcos Control And Protection Relay

    HW
    Secheron
    all versions

  • Secheron Sepcos Control And Protection Relay Firmware

    OS
    Secheron
    1.23.0 – 1.23.21 (excl.)1.24.0 – 1.24.8 (excl.)1.25.0 – 1.25.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-1668CRITICAL9.8PL ✓same product

Słabe domyślne hasło root w firmware Secheron SEPCOS umożliwia RCE

CVE-2022-2103CRITICAL9.8PL ✓same product

Słabe uwierzytelnienie w Secheron Sepcos — nieautoryzowany dostęp przez FTP

CVE-2022-2104CRITICAL9.9PL ✓same product

Privilege escalation w Secheron SEPCOS — konto www-data z sudo bez hasła

CVE-2022-2105CRITICAL9.4PL ✓same product

Pominięcie kontroli JavaScript umożliwia zmianę uprawnień bez uwierzytelnienia w Secheron SEPCOS

CVE-2022-1667HIGH7.5same product

Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., fro...