CVE-2022-0902: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command…

critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
abb	rmc-100	>= unspecified < 2105457-037	2105457-037
abb	rmc-100-lite	>= unspecified < 2106229-011	2106229-011
abb	rmc-100-lite_firmware	< 2106229-011	2106229-011
abb	rmc-100_firmware	< 2105457-037	2105457-037
abb	udc	>= unspecified < 2106177-007	2106177-007
abb	udc_firmware	< 2106177-007	2106177-007
abb	uflog5	>= unspecified < 2105298-024	2105298-024
abb	uflog5_firmware	< 2105298-024	2105298-024
abb	xfcg5	>= unspecified < 2105805-016	2105805-016
abb	xfcg5_firmware	< 2105805-016	2105805-016
abb	xio	>= unspecified < 2106198-008	2106198-008
abb	xio_firmware	< 2106198-008	2106198-008
abb	xrcg5	>= unspecified < 2105864-016	2105864-016
abb	xrcg5_firmware	< 2105864-016	2105864-016