CVE Vulnerability

CVE-2022-29960

Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities.

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.forescout.com/blog/ Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03 Not Applicable Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03 Third Party Advisory US Government Resource
Configurations

Configuration 1

cpe:2.3:a:emerson:openbsi:5.9:sp1:*:*:*:*:*:*
cpe:2.3:a:emerson:openbsi:5.9:sp2:*:*:*:*:*:*
cpe:2.3:a:emerson:openbsi:5.9:sp3:*:*:*:*:*:*
cpe:2.3:a:emerson:openbsi:5.9:-:*:*:*:*:*:*
cpe:2.3:a:emerson:openbsi:*:*:*:*:*:*:*:*
Information

Published : 2022-07-26 10:15

Updated : 2022-08-16 05:55

NVD link : CVE-2022-29960

Mitre link : CVE-2022-29960

Products Affected
No products.
CWE
CWE-798