CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-24-023-01: APsystems Energy Communication Unit (ECU-C) Power Control Software ↗ source

January 23, 2024 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-01

Summary

Successful exploitation of this vulnerability could allow an attacker to access sensitive data and execute specific commands and functions with full admin rights without authenticating. CVE-2022-44037: APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights. This could lead to multiple attacks in the product's range.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-24-023-01
Status
Final · version 1
Initial release
2024-01-23
Last revised
2024-01-23
Vendor
APsystems
Critical infrastructure sectors
Energy
Deployed
Worldwide
Vendor headquarters
United States

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: CISA

Affected products (1)
  • Energy Communication Unit Power Control Software — C1.2.2, v3.11.4, W2.1.NA, v4.1SAA, v4.1NA

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2022-44037 CWE-284 Improper Access Control 8.8 High APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights. This could lead to multiple attacks in the product's range.

Mitigation: APSystems has not responded to requests to work with CISA to mitigate this vulnerability. Users of the affected product are encouraged to contact APSystems support for additional information. ↗

Affected, fixed & timeline

Affected:

  • Energy Communication Unit Power Control Software C1.2.2
  • Energy Communication Unit Power Control Software v3.11.4
  • Energy Communication Unit Power Control Software W2.1.NA
  • Energy Communication Unit Power Control Software v4.1SAA
  • Energy Communication Unit Power Control Software v4.1NA

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2022-44037 8.8 High n/a n/a An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attacke…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.