Jacinto Moral Matellán

**Name of the Vulnerable Software and Affected Versions** ekorCCP and ekorRCI (affected versions not specified) **Description** The issue concerns incorrect authorization in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organization without being authenticated within the web server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ekorCCP and ekorRCI (affected versions not specified) **Description** The issue allows a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server. This exposure of sensitive information can potentially lead to unauthorized access to sensitive data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ekorCCP and ekorRCI (affected versions not specified) **Description** The issue is an operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges, or set up a backdoor. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ekorCCP and ekorRCI (affected versions not specified) **Description** The issue allows an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ekorCCP (affected versions not specified) ekorRCI (affected versions not specified) **Description** The issue arises due to access to the FTP service using default credentials. This can allow an attacker to modify critical files, potentially leading to the creation of new users, deletion or modification of existing users, modification of configuration files, or the installation of rootkits or backdoors. **Recommendations** For ekorCCP, consider disabling access to the FTP service until a secure configuration or update is available. For ekorRCI, restrict the use of default credentials for the FTP service to minimize the risk of exploitation. As a temporary workaround, avoid using the FTP service with default credentials until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.