Riskcovery

CVE-2022-0902

ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access

State
Published
Severity
8.1 High
Published
Jul 21, 2022
Updated
Sep 17, 2024
Reserved
Mar 9, 2022

Read the record on cve.org

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HABB

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

ProductVersions
RMC-100 (Standard)ABB
  • before 2105457-037Affected
RMC-100-LITEABB
  • before 2106229-011Affected
XIOABB
  • before 2106198-008Affected
XFCG5ABB
  • before 2105805-016Affected
XRCG5ABB
  • before 2105864-016Affected
uFLOG5ABB
  • before 2105298-024Affected
UDCABB
  • before 2106177-007Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.