CVE-2022-0902
High
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.
SeverityHigh
CVSS8.1
Exploit probability—
ProductAbb Rmc-100 Firmware
PublishedJul 21, 2022
First seenJul 21, 2022
Weakness typeCWE-22Path traversalCWE-77Command injection
How to fix
Update
- abb rmc-100_firmware2105457-037 or later
- abb rmc-100-lite_firmware2106229-011 or later
- abb xio_firmware2106198-008 or later
- abb xfcg5_firmware2105805-016 or later
- abb xrcg5_firmware2105864-016 or later
- abb uflog5_firmware2105298-024 or later
- abb udc_firmware2106177-007 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| abb rmc-100_firmware | v < 2105457-037 | 2105457-037 |
| abb rmc-100-lite_firmware | v < 2106229-011 | 2106229-011 |
| abb xio_firmware | v < 2106198-008 | 2106198-008 |
| abb xfcg5_firmware | v < 2105805-016 | 2105805-016 |
| abb xrcg5_firmware | v < 2105864-016 | 2105864-016 |
| abb uflog5_firmware | v < 2105298-024 | 2105298-024 |
| abb udc_firmware | v < 2106177-007 | 2106177-007 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.