{"id":"CVE-2022-0902","aliases":["EUVD-2022-15934","GHSA-844m-rhr6-873v"],"status":"published","title":"ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.16918,"percentile":0.97078,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-77"],"published":"2022-07-21T15:34:49Z","modified":"2026-06-17T04:21:27Z","products":[{"vendor":"abb","product":"rmc-100 (standard)"},{"vendor":"abb","product":"rmc-100-lite"},{"vendor":"abb","product":"rmc-100-lite_firmware"},{"vendor":"abb","product":"rmc-100_firmware"},{"vendor":"abb","product":"udc"},{"vendor":"abb","product":"udc_firmware"},{"vendor":"abb","product":"uflog5"},{"vendor":"abb","product":"uflog5_firmware"},{"vendor":"abb","product":"xfcg5"},{"vendor":"abb","product":"xfcg5_firmware"},{"vendor":"abb","product":"xio"},{"vendor":"abb","product":"xio_firmware"},{"vendor":"abb","product":"xrcg5"},{"vendor":"abb","product":"xrcg5_firmware"}],"references":[{"url":"https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0927\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026_ga","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0902"},{"url":"https://github.com/advisories/GHSA-844m-rhr6-873v"}],"sources":{"cve":[{"id":"CVE-2022-0902","title":"ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.","status":"published","published":"2022-07-21T15:34:49.705Z","modified":"2024-09-17T02:00:38.883Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-77"],"updated_at":"2026-11-02T14:34:42.028422Z"}],"euvd":[{"id":"EUVD-2022-15934","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.","status":"published","published":"2022-07-21T15:34:49Z","modified":"2024-09-17T02:00:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:44.789987Z"}],"ghsa":[{"id":"GHSA-844m-rhr6-873v","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper...","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.","status":"published","published":"2022-07-22T00:00:34Z","modified":"2023-01-27T05:06:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:42:55.025134Z"}],"nvd":[{"id":"CVE-2022-0902","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.","status":"published","published":"2022-07-21T16:15:08.61Z","modified":"2026-06-17T04:21:27.373Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22","CWE-77"],"updated_at":"2026-11-02T14:07:24.037422Z"}]}}