Ormazabal vulnerabilities
We track 5 vulnerabilities in Ormazabal products across 4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 19, 2023.
Latest Ormazabal vulnerabilities
- 8.8 High severity
ekorCCP: Cross-Site Request Forgery
Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.
- 9.8 Critical severity
ekorCCP: Use of Hard-coded Credentials
Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users
- 8.8 High severity
ekorCCP: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
- 7.5 High severity
ekorCCP: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server.
- 7.5 High severity
ekorCCP: Incorrect Authorization
Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server.