CVE-2022-47557

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-916

Affected software

Vendor	Product	Versions
Ormazabal	ekorCCP	601j
Ormazabal	ekorRCI	601j

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-productsThird Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-productsThird Party Advisory

Timeline

Published: Sep 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-475589.8Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability ca CVE-2022-475598.8Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious act CVE-2022-47565.4The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them b CVE-2022-475606.5The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious ac CVE-2022-475615.5The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which CVE-2022-475627.5Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.CVE-2022-47575.4The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them CVE-2022-475777.8An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete CVE-2022-475787.8An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete CVE-2022-47585.4The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back CVE-2022-475817.5Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request.CVE-2022-475839.8Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.