What is CVE-2022-2640?

CVE-2022-2640 is a high-severity vulnerability in Horner Automation Remote Compact Controller (Rcc) 972, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2022-12-02.

How severe is CVE-2022-2640?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Horner Automation Remote Compact Controller (Rcc) 972

CVE-2022-2640

The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer…

EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Horner Automation Remote Compact Controller (Rcc) 972 — versions Firmware Version 15.40
Hornerautomation Rcc972
Hornerautomation Rcc972_firmware — versions 15.40

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

ics-cert@hq.dhs.gov (US Government Resource, Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2022-2640?: CVE-2022-2640 is a high-severity vulnerability in Horner Automation Remote Compact Controller (Rcc) 972, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2022-12-02.
How severe is CVE-2022-2640?: High severity. CVSS v3 base score is 7.5 out of 10.