CVE Vulnerabilities

CVE-2022-2104

Improper Privilege Management

Published: Jun 24, 2022 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Sepcos_control_and_protection_relay_firmware Secheron 1.23.0 (including) 1.23.21 (excluding)
Sepcos_control_and_protection_relay_firmware Secheron 1.24.0 (including) 1.24.8 (excluding)
Sepcos_control_and_protection_relay_firmware Secheron 1.25.0 (including) 1.25.3 (excluding)

Potential Mitigations

References