Lucene search

MitreCVE-2022-30262

HistoryAug 17, 2022 - 3:15 p.m.

CVE-2022-30262

2022-08-1715:15:08

CWE-345

mitre

web.nvd.nist.gov

emerson

controlwave

next generation

rtus

firmware

integrity

bsap-ip protocol

firmware updates

cab archive

authentication

checksums

nvd

cve-2022-30262

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

10.4%

JSON

The Emerson ControlWave ‘Next Generation’ RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

Affected configurations

Nvd

Node

emersoncontrolwave_pac_firmwareRange≤2022-05-02

AND

emersoncontrolwave_pacMatch-

Node

emersoncontrolwave_micro_firmwareRange≤2022-05-02

AND

emersoncontrolwave_microMatch-

VendorProductVersionCPE
emersoncontrolwave_pac_firmware*cpe:2.3:o:emerson:controlwave_pac_firmware:*:*:*:*:*:*:*:*
emersoncontrolwave_pac-cpe:2.3:h:emerson:controlwave_pac:-:*:*:*:*:*:*:*
emersoncontrolwave_micro_firmware*cpe:2.3:o:emerson:controlwave_micro_firmware:*:*:*:*:*:*:*:*
emersoncontrolwave_micro-cpe:2.3:h:emerson:controlwave_micro:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emerson	controlwave_pac_firmware	*	cpe:2.3:o:emerson:controlwave_pac_firmware::::::::
emerson	controlwave_pac	-	cpe:2.3:h:emerson:controlwave_pac:-:::::::*
emerson	controlwave_micro_firmware	*	cpe:2.3:o:emerson:controlwave_micro_firmware::::::::
emerson	controlwave_micro	-	cpe:2.3:h:emerson:controlwave_micro:-:::::::*

References

www.cisa.gov/uscert/ics/advisories/icsa-22-221-02

www.forescout.com/blog/

Social References

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

10.4%

JSON

Related for CVE-2022-30262