What is CVE-2022-2640?

CVE-2022-2640 is a high-severity vulnerability in Horner Automation Remote Compact Controller (Rcc) 972, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2022-12-02.

How severe is CVE-2022-2640?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Horner Automation Remote Compact Controller (Rcc) 972

CVE-2022-2640

The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).

Published 2022-12-02 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.003 (17.2th percentile), scored 2026-10-25.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 17.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000

Affected products

Horner Automation Remote Compact Controller (Rcc) 972 — versions Firmware Version 15.40
Hornerautomation Rcc972
Hornerautomation Rcc972 Firmware — versions 15.40

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

www.cisa.gov/uscert/ics/advisories/icsa-22-335-02 (US Government Resource, Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2022-2640?: CVE-2022-2640 is a high-severity vulnerability in Horner Automation Remote Compact Controller (Rcc) 972, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2022-12-02.
How severe is CVE-2022-2640?: High severity. CVSS v3 base score is 7.5 out of 10.