CVE-2022-2640

Published: Dec 2, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This could allow an attacker to obtain credentials to run services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).

Affected (1)

Products: Hornerautomation: Rcc972 Firmware

Hornerautomation

1 product

Rcc972 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hornerautomation Rcc972 Firmware	Version 15.40

Running on/with	Platform Versions
Hornerautomation Rcc972	All versions

Related CWEs

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02

Source: ics-cert@hq.dhs.gov

PatchThird Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-22-335-02

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.