Critical ICSA-22-335-02 3 CVEs

Horner Automation Remote Compact Controller

Published Dec 1, 2022 · Updated Dec 1, 2022

Vendor: Horner Automation Product: RCC 972

Summary

Successful exploitation of these vulnerabilities could allow an attacker to obtain credentials to the affected device and obtain complete control.

Vulnerabilities 3

Critical 9.8

CVE-2022-2641

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an …

Horner Automation Remote Compact Controller (RCC) 972

Dec 12, 2022
High 7.5

CVE-2022-2640

The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vuln…

Horner Automation Remote Compact Controller (RCC) 972

Dec 12, 2022
High 7.5

CVE-2022-2642

Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out …

Horner Automation Remote Compact Controller (RCC) 972

Dec 12, 2022

Revision history

2022-12-01 #1
Publication Date

References

ICS Advisory ICSA-22-335-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-335-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-22-335-02
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf