Ormazabal manufactures electrical distribution and power-management control systems, with its vulnerability profile centered on firmware and control interfaces in products such as the eKORCCP and eKORRCI platforms. The recurring weakness classes—resource exhaustion, cleartext transmission, CSRF, sensitive-information exposure, and improper access control—reflect the security demands of networked industrial control equipment where authentication, encryption, and input validation are critical to availability and confidentiality. Defenders should prioritize inventory and network segmentation of these devices and monitor vendor advisories for firmware updates; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ormazabal over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-47555HIGH Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a ba | Sep 19, 2023 | 8.8 | 25 | NO | NO |
CVE-2022-47559HIGH Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting | Sep 19, 2023 | 8.8 | 24 | NO | NO |
CVE-2022-47558CRITICAL Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical f | Sep 19, 2023 | 9.8 | 24 | NO | NO |
CVE-2022-47554HIGH Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files contai | Sep 19, 2023 | 7.5 | 22 | NO | NO |
CVE-2022-47553HIGH Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated | Sep 19, 2023 | 7.5 | 22 | NO | NO |
CVE-2022-47562HIGH Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition. | Sep 20, 2023 | 7.5 | 21 | NO | NO |
CVE-2022-47556MEDIUM Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that i | Sep 19, 2023 | 6.5 | 19 | NO | NO |
CVE-2022-47560MEDIUM The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in. | Sep 20, 2023 | 6.5 | 18 | NO | NO |
CVE-2022-47557MEDIUM Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequ | Sep 19, 2023 | 6.1 | 18 | NO | NO |
CVE-2022-47561MEDIUM The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain creden | Sep 20, 2023 | 5.5 | 17 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ormazabal.
Media articles that mention a CVE ID that affects a product developed by Ormazabal — matched by CVE ID, not by vendor name.