CVE-2022-1668
📋 TL;DR
CVE-2022-1668 is a critical authentication vulnerability where weak default root credentials allow remote attackers to gain superuser privileges via SSH. This affects industrial control systems and other devices with exposed SSH ports using default credentials. Organizations using affected products with default configurations are at immediate risk.
💻 Affected Systems
- Rockwell Automation FactoryTalk AssetCentre
📦 What is this software?
Sepcos Control And Protection Relay Firmware by Secheron
View all CVEs affecting Sepcos Control And Protection Relay Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, exfiltrate sensitive data, disrupt operations, or pivot to other network systems.
Likely Case
Unauthorized root access leading to data theft, system manipulation, or ransomware deployment on vulnerable devices.
If Mitigated
No impact if strong credentials are enforced and SSH access is properly restricted.
🎯 Exploit Status
Attackers can use standard SSH clients with default credentials; no special tools required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk AssetCentre version 10.00.00.09
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1668.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk AssetCentre version 10.00.00.09 from Rockwell Automation. 2. Apply the update following vendor documentation. 3. Restart the system as required.
🔧 Temporary Workarounds
Change Default Root Password
linuxImmediately change the default root password to a strong, unique password.
passwd root
Restrict SSH Access
linuxLimit SSH access to specific IP addresses using firewall rules.
iptables -A INPUT -p tcp --dport 22 -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Change all default credentials immediately and enforce strong password policies.
- Disable SSH service if not required, or restrict access to trusted networks only.
🔍 How to Verify
Check if Vulnerable:
Check if FactoryTalk AssetCentre version is below 10.00.00.09 and if SSH is enabled with default credentials.Check Version:
Check FactoryTalk AssetCentre version in application interface or installation directory.Verify Fix Applied:
Verify installation of version 10.00.00.09 and confirm default credentials are changed.📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts followed by successful root login
- SSH connections from unexpected IP addresses
Network Indicators:
- SSH traffic to port 22 from external sources
- Unusual SSH session patterns
SIEM Query:
source="ssh_logs" (event="Accepted password" AND user="root") | stats count by src_ip