CVE-2022-2640

Name of the Vulnerable Software and Affected Versions Horner Automation's RCC 972 version 15.40

Description The configuration files of the affected device are encrypted with weak XOR encryption, making them vulnerable to reverse engineering. This could allow an attacker to obtain credentials for running services such as File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP).

Recommendations For version 15.40, consider disabling or restricting access to FTP and HTTP services until a patch or update is available to address the weak XOR encryption. As a temporary workaround, restrict access to configuration files to minimize the risk of exploitation.