CVE-2022-2103
📋 TL;DR
This vulnerability allows attackers with weak credentials to access TCP ports via open FTP ports, enabling them to read sensitive files and write to remotely executable directories. It affects industrial control systems and other devices with vulnerable FTP configurations. Organizations using affected products with default or weak FTP authentication are at risk.
💻 Affected Systems
- Industrial control systems and devices with vulnerable FTP implementations
📦 What is this software?
Sepcos Control And Protection Relay Firmware by Secheron
View all CVEs affecting Sepcos Control And Protection Relay Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, or disruption of critical industrial operations.
Likely Case
Unauthorized file access and potential malware installation through FTP directory writes.
If Mitigated
Limited impact with proper authentication controls and network segmentation in place.
🎯 Exploit Status
Exploitation requires weak credentials but is straightforward once obtained. Attackers can use common FTP clients and brute-force tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor-specific updates
Vendor Advisory: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
Restart Required: Yes
Instructions:
1. Identify affected systems using vendor documentation
2. Apply vendor-provided patches or firmware updates
3. Restart affected systems to apply changes
4. Verify patch installation and functionality
🔧 Temporary Workarounds
Disable FTP Service
linuxCompletely disable FTP services if not required for operations
systemctl stop ftpd
systemctl disable ftpd
Implement Strong Authentication
linuxEnforce complex passwords and account lockout policies for FTP access
passwd -l weakuser
chage -M 90 -m 7 -W 14 ftpuser
🧯 If You Can't Patch
- Implement network segmentation to isolate FTP services from critical systems
- Deploy intrusion detection systems to monitor for FTP brute-force attempts
🔍 How to Verify
Check if Vulnerable:
Check if FTP service is running and accessible with weak/default credentials using nmap or ftp clientsCheck Version:
Check vendor-specific version commands or firmware version displaysVerify Fix Applied:
Verify FTP service is either disabled or requires strong authentication; test with credential attempts📡 Detection & Monitoring
Log Indicators:
- Multiple failed FTP login attempts
- Successful FTP logins from unusual IP addresses
- File transfer logs showing sensitive file access
Network Indicators:
- FTP traffic to/from unexpected sources
- Brute-force patterns on FTP port 21
SIEM Query:
source="ftp.log" (action="failed" OR action="success") | stats count by src_ip, user