CVE-2022-47558 - Vulnerability Details - OpenCVE

Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00122.

Key SSVC decision points have not yet been added.

Vendors	Products
Ormazabal	Ekorccp Ekorccp Firmware Ekorrci Ekorrci Firmware

Configuration 1 [-]

AND

cpe:2.3:o:ormazabal:ekorrci_firmware:601j:*:*:*:*:*:*:*

cpe:2.3:h:ormazabal:ekorrci:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:ormazabal:ekorccp_firmware:601j:*:*:*:*:*:*:*

cpe:2.3:h:ormazabal:ekorccp:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-50318	Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.

Fixes

Solution

Ormazabal recommends upgrading to updated models.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products

History

No history.

MITRE

Status: PUBLISHED

Assigner: INCIBE

Published: 2023-09-19T12:58:48.452Z

Updated: 2024-08-03T14:55:08.506Z

Reserved: 2022-12-19T16:35:50.462Z

Link: CVE-2022-47558

Vulnrichment

Updated: 2024-08-03T14:55:08.506Z

NVD

Status : Modified

Published: 2023-09-19T13:16:21.193

Modified: 2024-11-21T07:32:11.513

Link: CVE-2022-47558

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-47558", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2022-12-19T16:35:50.462Z", "datePublished": "2023-09-19T12:58:48.452Z", "dateUpdated": "2024-08-03T14:55:08.506Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ekorCCP", "vendor": "Ormazabal", "versions": [{"status": "affected", "version": "601j"}]}, {"defaultStatus": "unaffected", "product": "ekorRCI", "vendor": "Ormazabal", "versions": [{"status": "affected", "version": "601j"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jacinto Moral Matell\u00e1n"}], "datePublic": "2023-08-22T10:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors."}], "value": "Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2023-09-19T12:58:48.452Z"}, "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Ormazabal recommends upgrading to updated models."}], "value": "Ormazabal recommends upgrading to updated models."}], "source": {"discovery": "EXTERNAL"}, "tags": ["unsupported-when-assigned"], "title": "Improper Access Control in Ormazabal products", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-47558", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T14:14:26.385555Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:ormazabal:ekorccp:-:*:*:*:*:*:*:*"], "vendor": "ormazabal", "product": "ekorccp", "versions": [{"status": "affected", "version": "601j"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:ormazabal:ekorrci:-:*:*:*:*:*:*:*"], "vendor": "ormazabal", "product": "ekorrci", "versions": [{"status": "affected", "version": "601j"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:16:27.304Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:55:08.506Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:55:08.506Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-47558", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T14:14:26.385555Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:ormazabal:ekorccp:-:*:*:*:*:*:*:*"], "vendor": "ormazabal", "product": "ekorccp", "versions": [{"status": "affected", "version": "601j"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:ormazabal:ekorrci:-:*:*:*:*:*:*:*"], "vendor": "ormazabal", "product": "ekorrci", "versions": [{"status": "affected", "version": "601j"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T14:17:10.324Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Improper Access Control in Ormazabal products", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jacinto Moral Matell\u00e1n"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ormazabal", "product": "ekorCCP", "versions": [{"status": "affected", "version": "601j"}], "defaultStatus": "unaffected"}, {"vendor": "Ormazabal", "product": "ekorRCI", "versions": [{"status": "affected", "version": "601j"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Ormazabal recommends upgrading to updated models.", "supportingMedia": [{"type": "text/html", "value": "Ormazabal recommends upgrading to updated models.", "base64": false}]}], "datePublic": "2023-08-22T10:00:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.", "supportingMedia": [{"type": "text/html", "value": "Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2023-09-19T12:58:48.452Z"}}}, "cveMetadata": {"cveId": "CVE-2022-47558", "state": "PUBLISHED", "dateUpdated": "2024-08-03T14:55:08.506Z", "dateReserved": "2022-12-19T16:35:50.462Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2023-09-19T12:58:48.452Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ormazabal:ekorrci_firmware:601j:*:*:*:*:*:*:*", "matchCriteriaId": "34615054-34DD-469E-80FC-F5C3F74850AC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ormazabal:ekorrci:-:*:*:*:*:*:*:*", "matchCriteriaId": "C5E73387-2229-4A85-A3A7-A0A2C1D74EA6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ormazabal:ekorccp_firmware:601j:*:*:*:*:*:*:*", "matchCriteriaId": "3A8F0358-F8FA-4AEB-B88E-C56E2E965B7B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ormazabal:ekorccp:-:*:*:*:*:*:*:*", "matchCriteriaId": "77B2D423-E767-495C-93C7-4C4B724BE3E3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "cve-coordination@incibe.es", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors."}, {"lang": "es", "value": "** NO COMPATIBLE CUANDO EST\u00c1 ASIGNADO ** Los dispositivos ekorCCP y ekorRCI son vulnerables debido al acceso al servicio FTP mediante credenciales predeterminadas. La explotaci\u00f3n de esta vulnerabilidad puede permitir a un atacante modificar archivos cr\u00edticos que podr\u00edan permitir la creaci\u00f3n de nuevos usuarios, eliminar o modificar usuarios existentes, modificar archivos de configuraci\u00f3n, instalar rootkits o puertas traseras."}], "id": "CVE-2022-47558", "lastModified": "2024-11-21T07:32:11.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "cve-coordination@incibe.es", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-19T13:16:21.193", "references": [{"source": "cve-coordination@incibe.es", "tags": ["Third Party Advisory"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}