CVE-2022-2104 : Exploit Details and Defense Strategies

A critical vulnerability has been identified in the SEPCOS Control and Protection Relay firmware package developed by Secheron. This CVE was reported to CISA by a group of security researchers. Read on to understand the impact, technical details, and mitigation strategies associated with CVE-2022-2104.

Understanding CVE-2022-2104

This section delves into the details of the vulnerability, its impact, and the affected systems.

What is CVE-2022-2104?

The vulnerability involves the www-data (Apache web server) account being configured to run sudo with no password for many commands, including /bin/sh and /bin/bash.

The Impact of CVE-2022-2104

With a CVSS score of 9.9, this critical vulnerability has a high impact on confidentiality, integrity, and availability. It requires low privileges and can be exploited over a network.

Technical Details of CVE-2022-2104

This section provides a deeper insight into the vulnerability, including its description, affected systems, and exploitation mechanism.

Vulnerability Description

The vulnerability allows unauthorized users to execute commands as sudo without a password, potentially leading to unauthorized access and escalation of privileges.

Affected Systems and Versions

All versions of the SEPCOS Control and Protection Relay firmware package prior to 1.23.21 are vulnerable to this exploit.

Exploitation Mechanism

The vulnerability can be exploited remotely over a network with low complexity, impacting the confidentiality and integrity of the system.

Mitigation and Prevention

In response to CVE-2022-2104, Secheron recommends immediate actions and long-term security practices to mitigate the risk.

Immediate Steps to Take

Users are advised to update the SEPCOS firmware to the latest version. Additional workarounds include strict network configuration, limiting remote access, and monitoring device logs for unauthorized activities.

Long-Term Security Practices

To enhance long-term security, users should implement approved device connections, avoid personal peripherals on critical devices, and conduct regular security checks on the system.

Patching and Updates

Secheron advises updating to the following versions:

SEPCOS Single Package firmware (1.23.xx feature level): Update to 1.23.22 or higher version
SEPCOS Single Package firmware (1.24.xx feature level): Update to 1.24.8 or higher version
SEPCOS Single Package firmware (1.25.xx feature level): Update to 1.25.3 or higher version