CVE-2022-29959

Published: Aug 16, 2022Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.

Affected (5)

Products: Emerson: Openbsi

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Emerson Openbsi	Before 5.9
Emerson Openbsi	Version 5.9
Emerson Openbsi	Version 5.9 sp1
Emerson Openbsi	Version 5.9 sp2
Emerson Openbsi	Version 5.9 sp3

Related CWEs

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (4)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03

Source: cve@mitre.org

MitigationThird Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: cve@mitre.org

Third Party Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.