CVE-2022-30316

Опубликовано: 28 июл. 2022

Источник: nvd

CVSS3: 6.8

EPSS Низкий

Описание

Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The potential impact is: Firmware manipulation. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 communication FTA serial interface and Enea POLO bootloader for firmware management purposes. An engineering workstation running the Safety Builder software communicates via serial or serial-over-ethernet link with the DCOM-232/485 interface. Firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks. Firmware images are unsigned. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize hardcoded cred

Ссылки

https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
Mitigation
Third Party Advisory
US Government Resource
https://www.forescout.com/blog/
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
Mitigation
Third Party Advisory
US Government Resource
https://www.forescout.com/blog/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:honeywell:safety_manager_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:safety_manager:-:*:*:*:*:*:*:*

EPSS

Процентиль: 32%

0.0012

Низкий

6.8 Medium

CVSS3

Дефекты

CWE-354

Связанные уязвимости

GHSA-xw3r-v728-68pj

CVSS3: 6.8

github

около 3 лет назад

BDU:2022-03750

CVSS3: 9.8

fstec