CVE-2022-29952

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols 60005/TCP, 60007/TCP for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration BNMC software. These protocol...

CVE-2022-29953

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality...

Authentication flaw

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols 60005/TCP, 60007/TCP for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration BNMC software. These protocol...

Hardcoded credentials

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality...

CVE-2022-29953

The CVE-2022-29953 entry concerns the Bently Nevada 3700 series condition monitoring equipment. A maintenance interface on port 4001/TCP uses undocumented, hardcoded credentials, allowing an attacker who can reach the interface to take over its functionality. Affected products include Bently Neva...

CVE-2022-29953

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality...

CVE-2022-29952

CVE-2022-29952 affects Bently Nevada condition monitoring equipment (e.g., 3701/4X, 60M100) and relates to missing authentication for the TDI command/data protocols on ports 60005/TCP and 60007/TCP. Public documentation confirms that these protocols provide configuration management and historical...

CVE-2022-29952

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols 60005/TCP, 60007/TCP for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration BNMC software. These protocol...

Baker Hughes Bently Nevada 3701/40 访问控制错误漏洞

The Baker Hughes Bently Nevada 3701/40 is a Condition Detection System from Baker Hughes USA. An Access Control Error vulnerability exists in the Bently Nevada 3701/4X Series and 60M100 3701/60 versions, which stems from affected products having hard-coded Maintenance Interface credentials in the...

Bently Nevada 3701/40 和 60M100 (3701/60) 信任管理问题漏洞

The Baker Hughes Bently Nevada 3701/40 and the Bently Nevada 60M100 3701/60 are both a Condition Detection System from Baker Hughes USA. A trust management issue vulnerability exists in the Bently Nevada 3701/40 and 60M100 3701/60 versions, which stems from the fact that the affected products hav...

Bently Nevada ADAPT 3701/4X Series and 60M100

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Bently Nevada Equipment: 3701/4X series and 60M100 3701/60 Condition Monitoring System Vulnerabilities: Use of Hard-coded Credentials, Missing Authentication for Critical Function CISA is aware of a...

The vulnerability of Bently Nevada 3701 monitoring and protection systems, related to the use of pre-installed credentials, allows a intruder to execute arbitrary commands.

The vulnerability of Bently Nevada 3701 monitoring and protection systems lies in the use of pre-installed credentials. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the TDI protocol implementation in Bently Nevada’s monitoring and protection equipment allows a intruder to trigger a maintenance failure.

The vulnerability of the TDI protocol implementation in Bently Nevada’s monitoring and protection equipment systems is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to cause malfunctions in the maintenance services...

PT-2022-3155 · Bently Nevada · Bently Nevada Condition Monitoring Equipment +1

Name of the Vulnerable Software and Affected Versions: Bently Nevada condition monitoring equipment through 2022-04-29 Description: The issue is related to the mishandling of authentication in Bently Nevada condition monitoring equipment. It utilizes the TDI command and data protocols for...

PT-2022-3154 · Bently Nevada · Bently Nevada 3700 Series

Name of the Vulnerable Software and Affected Versions: Bently Nevada 3700 series versions through 2022-04-29 Description: The issue is related to the use of hardcoded credentials in the maintenance interface of the Bently Nevada 3700 series. This interface is accessible on port 4001/TCP. An...

CISA Releases Security Advisories Related to OT:ICEFALL (Insecure by Design) Report

CISA is aware that Forescout researchers have released OT:ICEFALL, a report on 56 vulnerabilities caused by insecure-by-design practices in operational technology across multiple vendors. The vulnerabilities are divided into four main categories: insecure engineering protocols, weak cryptography ...

CVE-2021-32997

The affected Baker Hughes Bentley Nevada products 3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01...

Design/Logic Flaw

The affected Baker Hughes Bentley Nevada products 3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01...

CVE-2021-32997 Baker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational Effort

The affected Baker Hughes Bentley Nevada products 3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01...

CVE-2021-32997

CVE-2021-32997 affects Baker Hughes Bently Nevada 3500 equipment. Affected products and versions include System 1 6.x (Part 3060/00, 6.98 and prior), System 1 (Part 3071/xx & 3072/xx, 21.1 HF1 and prior), 3500 Rack Configuration (Part 129133-01, 6.4 and prior), and 3500/22M Firmware (Part 288055-...