CVE-2022-30274: Critical severity motorola ace1000 vulnerability

Published Jul 26, 2022

Updated

The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm (TEA) in ECB mode using a hardcoded key. Similarly, the ACE1000 RTU can route MDLC traffic over Extended Command and Management Protocol (XCMP) and Network Layer (XNL) networks via the MDLC driver. Authentication to the XNL port is protected by TEA in ECB mode using a hardcoded key.

Affected Software

3 affected components

Motorola Ace1000 Firmware

Motorola ACE1000

Motorola Solutions ACE1000

Event History

Jul 26, 2022

CVE Published

via MITRE·10:06 PM

Data Sourced

via MITRE·10:06 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-179-06

Frequently Asked Questions

What is the vulnerability ID for this Motorola ACE1000 RTU vulnerability?

The vulnerability ID for this Motorola ACE1000 RTU vulnerability is CVE-2022-30274.

What is the severity rating of CVE-2022-30274?

The severity rating of CVE-2022-30274 is critical.

How does the Motorola ACE1000 RTU use ECB encryption unsafely?

The Motorola ACE1000 RTU uses ECB encryption unsafely by storing credentials in ECB mode using a hardcoded encryption algorithm.

What is the affected software for CVE-2022-30274?

The affected software for CVE-2022-30274 is the Motorola Ace1000 Firmware.

How can I fix the CVE-2022-30274 vulnerability?

To fix the CVE-2022-30274 vulnerability, users should apply the latest firmware update provided by Motorola.