CVE-2022-29959
First published: Tue Aug 16 2022(Updated: )
Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Emerson OpenBSI | <5.9 | |
| Emerson OpenBSI | =5.9 | |
| Emerson OpenBSI | =5.9-sp1 | |
| Emerson OpenBSI | =5.9-sp2 | |
| Emerson OpenBSI | =5.9-sp3 | |
| Emerson OpenBSI: Versions 5.9 SP3 and prior |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-29959?
CVE-2022-29959 is a vulnerability that affects Emerson OpenBSI through 2022-04-29 and mishandles credential storage.
What is Emerson OpenBSI?
Emerson OpenBSI is an engineering environment for the ControlWave and Bristol Babcock line of RTUs.
How does Emerson OpenBSI provide access control functionality?
Emerson OpenBSI provides access control functionality through user authentication and privilege management.
What versions of Emerson OpenBSI are affected by CVE-2022-29959?
Emerson OpenBSI versions up to and including 5.9, 5.9-sp1, 5.9-sp2, and 5.9-sp3 are affected by CVE-2022-29959.
What is the severity level of CVE-2022-29959?
CVE-2022-29959 has a severity level of medium with a CVSS score of 5.5.
How can I learn more about CVE-2022-29959?
You can find more information about CVE-2022-29959 on the official CISA and Forescout websites.
- collector/nvd-index
- agent/author
- agent/type
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/references
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- agent/trending
- vendor/emerson
- canonical/emerson openbsi
- version/emerson openbsi/5.9
- version/emerson openbsi/5.9-sp1
- version/emerson openbsi/5.9-sp2
- version/emerson openbsi/5.9-sp3
- canonical/emerson openbsi: versions 5.9 sp3 and prior