Lucene search

MitreCVE-2022-29953

HistoryJul 26, 2022 - 10:15 p.m.

CVE-2022-29953

2022-07-2622:15:10

CWE-798

mitre

web.nvd.nist.gov

bently nevada

3700 series

condition monitoring equipment

cve-2022-29953

maintenance interface

port 4001

tcp

hardcoded credentials

cybersecurity

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.

Affected configurations

Nvd

Node

bakerhughesbently_nevada_3701\/40_firmwareRange<4.1

AND

bakerhughesbently_nevada_3701\/40Match-

Node

bakerhughesbently_nevada_3701\/44_firmwareRange<4.1

AND

bakerhughesbently_nevada_3701\/44Match-

Node

bakerhughesbently_nevada_3701\/46_firmwareRange<4.1

AND

bakerhughesbently_nevada_3701\/46Match-

Node

bakerhughesbently_nevada_60m100_firmwareMatch-

AND

bakerhughesbently_nevada_60m100Match-

VendorProductVersionCPE
bakerhughesbently_nevada_3701\/40_firmware*cpe:2.3:o:bakerhughes:bently_nevada_3701\/40_firmware:*:*:*:*:*:*:*:*
bakerhughesbently_nevada_3701\/40-cpe:2.3:h:bakerhughes:bently_nevada_3701\/40:-:*:*:*:*:*:*:*
bakerhughesbently_nevada_3701\/44_firmware*cpe:2.3:o:bakerhughes:bently_nevada_3701\/44_firmware:*:*:*:*:*:*:*:*
bakerhughesbently_nevada_3701\/44-cpe:2.3:h:bakerhughes:bently_nevada_3701\/44:-:*:*:*:*:*:*:*
bakerhughesbently_nevada_3701\/46_firmware*cpe:2.3:o:bakerhughes:bently_nevada_3701\/46_firmware:*:*:*:*:*:*:*:*
bakerhughesbently_nevada_3701\/46-cpe:2.3:h:bakerhughes:bently_nevada_3701\/46:-:*:*:*:*:*:*:*
bakerhughesbently_nevada_60m100_firmware-cpe:2.3:o:bakerhughes:bently_nevada_60m100_firmware:-:*:*:*:*:*:*:*
bakerhughesbently_nevada_60m100-cpe:2.3:h:bakerhughes:bently_nevada_60m100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bakerhughes	bently_nevada_3701\/40_firmware	*	cpe:2.3:o:bakerhughes:bently_nevada_3701\/40_firmware::::::::
bakerhughes	bently_nevada_3701\/40	-	cpe:2.3:h:bakerhughes:bently_nevada_3701\/40:-:::::::*
bakerhughes	bently_nevada_3701\/44_firmware	*	cpe:2.3:o:bakerhughes:bently_nevada_3701\/44_firmware::::::::
bakerhughes	bently_nevada_3701\/44	-	cpe:2.3:h:bakerhughes:bently_nevada_3701\/44:-:::::::*
bakerhughes	bently_nevada_3701\/46_firmware	*	cpe:2.3:o:bakerhughes:bently_nevada_3701\/46_firmware::::::::
bakerhughes	bently_nevada_3701\/46	-	cpe:2.3:h:bakerhughes:bently_nevada_3701\/46:-:::::::*
bakerhughes	bently_nevada_60m100_firmware	-	cpe:2.3:o:bakerhughes:bently_nevada_60m100_firmware:-:::::::*
bakerhughes	bently_nevada_60m100	-	cpe:2.3:h:bakerhughes:bently_nevada_60m100:-:::::::*

References

www.cisa.gov/uscert/ics/advisories/icsa-22-188-02

www.forescout.com/blog/

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

Related for CVE-2022-29953