What’s Vulnerable › Vulnerabilities

CVE-2022-4333: Sprecher: Sprecon maintenance access with hardcoded credentials

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-01 · updated 2026-06-17
• Weakness: CWE-798

Description

Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be deactivated according to Sprecher's hardening guidelines.

Affected products

• Sprecher-Automation Sprecon-E-C Firmware: all versions
• Sprecher-Automation Sprecon-E-P Dl6-1 Firmware: all versions
• Sprecher-Automation Sprecon-E-P Dq6-1 Firmware: all versions
• Sprecher-Automation Sprecon-E-P Ds6-0 Firmware: all versions
• Sprecher-Automation Sprecon-E-T3 Firmware: all versions
• Sprecher-Automation Sprecon-E-Tc Ax-3110 Firmware: all versions
• Sprecher-Automation Sprecon-E Ap-2200 Firmware: all versions
• Sprecher-Automation Sprecon-E Cp-2131 Firmware: all versions
• Sprecher-Automation Sprecon-E Cp-2330 Firmware: all versions

References

• https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/2022-12_Advisories.pdf
• https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/2022-12_Advisories.pdf

Get alerted when CVE-2022-4333 or the next vulnerability affects your stack