CVE-2022-30262: Critical severity emerson controlwave pac vulnerability

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2022-30262.

Q: What is the severity of CVE-2022-30262?

The severity of CVE-2022-30262 is high with a severity value of 7.8.

Q: How does CVE-2022-30262 mishandle firmware integrity?

CVE-2022-30262 mishandles firmware integrity by utilizing the BSAP-IP protocol to transmit firmware updates that are supplied as CAB archive files containing a binary firmware image, which were found to have no integrity checks in place.

Q: Are the Emerson ControlWave PAC and ControlWave Micro vulnerable to CVE-2022-30262?

The Emerson ControlWave PAC and ControlWave Micro are not vulnerable to CVE-2022-30262.

Published Aug 17, 2022

Updated

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

Affected Software

5 affected components

Emerson ControlWave

Emerson Controlwave Pac Firmware<=2022-05-02

Emerson Controlwave Pac

Emerson Controlwave Micro Firmware<=2022-05-02

Emerson ControlWave Micro

Event History

Aug 17, 2022

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-221-02

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-30262.

What is the severity of CVE-2022-30262?

The severity of CVE-2022-30262 is high with a severity value of 7.8.

Which software is affected by CVE-2022-30262?

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 are affected by CVE-2022-30262.

How does CVE-2022-30262 mishandle firmware integrity?