CVE-2022-30262
First published: Wed Aug 17 2022(Updated: )
The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Emerson Controlwave Pac Firmware | <=2022-05-02 | |
| Emerson Controlwave Pac | ||
| Emerson Controlwave Micro Firmware | <=2022-05-02 | |
| Emerson Controlwave Micro | ||
| Emerson ControlWave |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-30262.
What is the severity of CVE-2022-30262?
The severity of CVE-2022-30262 is high with a severity value of 7.8.
Which software is affected by CVE-2022-30262?
The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 are affected by CVE-2022-30262.
How does CVE-2022-30262 mishandle firmware integrity?
CVE-2022-30262 mishandles firmware integrity by utilizing the BSAP-IP protocol to transmit firmware updates that are supplied as CAB archive files containing a binary firmware image, which were found to have no integrity checks in place.
Are the Emerson ControlWave PAC and ControlWave Micro vulnerable to CVE-2022-30262?
The Emerson ControlWave PAC and ControlWave Micro are not vulnerable to CVE-2022-30262.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/severity
- agent/references
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/emerson
- canonical/emerson controlwave pac firmware
- version/emerson controlwave pac firmware/2022-05-02
- canonical/emerson controlwave pac
- canonical/emerson controlwave micro firmware
- version/emerson controlwave micro firmware/2022-05-02
- canonical/emerson controlwave micro
- canonical/emerson controlwave