CVE-2022-1667 : Vulnerability Insights and Analysis

A detailed analysis of CVE-2022-1667 focusing on the Secheron SEPCOS Control and Protection Relay vulnerability.

Understanding CVE-2022-1667

This CVE pertains to vulnerabilities found in the SEPCOS Control and Protection Relay firmware package by Secheron, impacting certain versions of the software.

What is CVE-2022-1667?

The vulnerability allows bypassing client-side JavaScript controls by directly running a JavaScript function to reboot the Programmable Logic Controller (PLC) or by loading a particular PHP script accessible via the browser console.

The Impact of CVE-2022-1667

With a CVSS base score of 7.5, this vulnerability poses a high risk by potentially enabling unauthorized rebooting of the PLC, leading to availability issues.

Technical Details of CVE-2022-1667

Taking a closer look at the technical aspects of the vulnerability.

Vulnerability Description

The flaw allows for the bypass of client-side JavaScript controls, presenting a significant risk of PLC reboot by executing specific functions.

Affected Systems and Versions

All versions of SEPCOS Control and Protection Relay firmware package with a version less than 1.23.21 are vulnerable.

Exploitation Mechanism

The vulnerability can be exploited by directly running a JS function or loading a specific PHP script via the browser console.

Mitigation and Prevention

Guidelines on how to mitigate and prevent potential exploitation of CVE-2022-1667.

Immediate Steps to Take

Update the SEPCOS firmware package to versions 1.23.22 or higher.
Implement network configurations limiting PLC communication to essential devices.
Close Ports 80 and 443 at the switch level to restrict remote access.

Long-Term Security Practices

Utilize approved devices exclusively to connect to PLCs.
Refrain from connecting personal peripherals to authorized devices.
Regularly monitor device logs for any unauthorized access.

Patching and Updates

Secheron suggests updating the SEPCOS Single Package firmware to the latest versions based on the feature level to address the vulnerability.