CVE-2022-30318
First published: Wed Aug 31 2022(Updated: )
Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. The affected components are characterized as: SSH. The potential impact is: Remote code execution, manipulate configuration, denial of service. The Honeywell ControlEdge PLC and RTU product line exposes an SSH service on port 22/TCP. Login as root to this service is permitted and credentials for the root user are hardcoded without automatically changing them upon first commissioning. The credentials for the SSH service are hardcoded in the firmware. The credentials grant an attacker access to a root shell on the PLC/RTU, allowing for remote code execution, configuration manipulation and denial of service.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Honeywell Controledge Plc Firmware | <r151.2 | |
| Honeywell ControlEdge PLC | ||
| Honeywell Controledge Rtu Firmware | <r151.2 | |
| Honeywell Controledge Rtu | ||
| Honeywell ControlEdge | <151.2 | 151.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-30318?
CVE-2022-30318 is a vulnerability in Honeywell ControlEdge through R151.1 that uses hard-coded credentials, potentially allowing remote code execution, configuration manipulation, and denial of service.
What is the severity of CVE-2022-30318?
CVE-2022-30318 has a severity rating of 9.8 out of 10, indicating it is critical.
Which components are affected by CVE-2022-30318?
The affected components of CVE-2022-30318 are SSH in Honeywell Controledge PLC Firmware and Honeywell Controledge RTU Firmware up to exclusive version R151.2.
How can CVE-2022-30318 be exploited?
CVE-2022-30318 can be exploited remotely to execute arbitrary code, manipulate configuration settings, and cause denial of service.
Is there a fix for CVE-2022-30318?
To mitigate CVE-2022-30318, it is recommended to update the affected Honeywell ControlEdge components to a version beyond R151.2.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/event
- agent/first-publish-date
- agent/description
- agent/references
- agent/severity
- agent/tags
- agent/softwarecombine
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/honeywell
- canonical/honeywell controledge plc firmware
- canonical/honeywell controledge plc
- canonical/honeywell controledge rtu firmware
- canonical/honeywell controledge rtu
- canonical/honeywell controledge