CVE-2022-29952

Опубликовано: 26 июл. 2022

Источник: nvd

CVSS3: 9.1

EPSS Низкий

Описание

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.

Ссылки

https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02
Mitigation
Third Party Advisory
US Government Resource
https://www.forescout.com/blog/
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02
Mitigation
Third Party Advisory
US Government Resource
https://www.forescout.com/blog/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_3701\/40_firmware:*:*:*:*:*:*:*:*

Версия до 4.1 (исключая)

cpe:2.3:h:bakerhughes:bently_nevada_3701\/40:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_3701\/44_firmware:*:*:*:*:*:*:*:*

Версия до 4.1 (исключая)

cpe:2.3:h:bakerhughes:bently_nevada_3701\/44:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_3701\/46_firmware:*:*:*:*:*:*:*:*

Версия до 4.1 (исключая)

cpe:2.3:h:bakerhughes:bently_nevada_3701\/46:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:bakerhughes:bently_nevada_60m100_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:bakerhughes:bently_nevada_60m100:-:*:*:*:*:*:*:*

EPSS

Процентиль: 61%

0.01027

Низкий

9.1 Critical

CVSS3

Дефекты

CWE-306

Связанные уязвимости

GHSA-xgjg-q85m-vvmx

CVSS3: 9.1

github

около 4 лет назад

EPSS

Процентиль: 61%

0.01027

Низкий

9.1 Critical

CVSS3

Дефекты

CWE-306