CVE-2022-47557

Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products	Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:ormazabal:ekorrci_firmware:601j:*:*:*:*:*:*:*

cpe:2.3:h:ormazabal:ekorrci:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:ormazabal:ekorccp_firmware:601j:*:*:*:*:*:*:*

cpe:2.3:h:ormazabal:ekorccp:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:32

Type	Values Removed	Values Added
References	~~() https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products - Third Party Advisory~~	() https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products - Third Party Advisory

21 Mar 2024, 02:44

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-19 13:16

Updated : 2024-11-21 07:32

NVD link : CVE-2022-47557

Mitre link : CVE-2022-47557

CVE.ORG link : CVE-2022-47557

JSON object : View

Products Affected

ormazabal

ekorrci_firmware
ekorccp_firmware
ekorrci
ekorccp

CWE

CWE-916

Use of Password Hash With Insufficient Computational Effort

{"id": "CVE-2022-47557", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cve-coordination@incibe.es"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "published": "2023-09-19T13:16:20.843", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}, {"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-916"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-916"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions."}, {"lang": "es", "value": "** NO COMPATIBLE CUANDO EST\u00c1 ASIGNADO ** Vulnerabilidad en ekorCCP y ekorRCI que podr\u00eda permitir a un atacante con acceso a la red donde se encuentra el dispositivo descifrar las credenciales de usuarios privilegiados, y posteriormente acceder al sistema para realizar acciones maliciosas."}], "lastModified": "2024-11-21T07:32:11.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ormazabal:ekorrci_firmware:601j:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34615054-34DD-469E-80FC-F5C3F74850AC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ormazabal:ekorrci:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C5E73387-2229-4A85-A3A7-A0A2C1D74EA6"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ormazabal:ekorccp_firmware:601j:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A8F0358-F8FA-4AEB-B88E-C56E2E965B7B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ormazabal:ekorccp:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "77B2D423-E767-495C-93C7-4C4B724BE3E3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve-coordination@incibe.es"}