← Back

CVE-2022-30262

nvd nist
Published: Aug 17, 2022Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

Affected (2)

Emerson
2 products
Controlwave Pac Firmware
Controlwave Micro Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Controlwave Pac Firmware
Up to 2022-05-02
Running on/withPlatform Versions
Emerson
Controlwave Pac
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Controlwave Micro Firmware
Up to 2022-05-02
Running on/withPlatform Versions
Emerson
Controlwave Micro
All versions

Related CWEs

CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (4)

Source: cve@mitre.org
MitigationThird Party AdvisoryUS Government Resource
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationThird Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.