FKIE_CVE-2022-29960

Vulnerability from fkie_nvd - Published: 2022-07-26 22:15 - Updated: 2024-11-21 07:00
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities.
References
cve@mitre.orghttps://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Not Applicable, Third Party Advisory, US Government Resource
cve@mitre.orghttps://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03Third Party Advisory, US Government Resource
cve@mitre.orghttps://www.forescout.com/blog/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Not Applicable, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.forescout.com/blog/Third Party Advisory
Impacted products
Vendor Product Version
emerson openbsi *
emerson openbsi 5.9
emerson openbsi 5.9
emerson openbsi 5.9
emerson openbsi 5.9
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emerson:openbsi:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B055F9B1-85D2-4B3B-B89B-4F21D8907EE4",
              "versionEndExcluding": "5.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emerson:openbsi:5.9:-:*:*:*:*:*:*",
              "matchCriteriaId": "C80F26CD-4EDC-48B9-BDE4-320B2E182A93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emerson:openbsi:5.9:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "CF9B7B1B-08A4-4EEB-BF30-66EC5C0453B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emerson:openbsi:5.9:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "7061F4DC-FEEF-422C-8542-83F96E708C20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emerson:openbsi:5.9:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "CFC9507C-8C8C-48E8-AB43-2237D5666FEF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities."
    },
    {
      "lang": "es",
      "value": "Emerson OpenBSI versiones hasta 29-04-2022, usa una criptograf\u00eda d\u00e9bil. Es un entorno de ingenier\u00eda para la l\u00ednea de RTUs ControlWave y Bristol Babcock. Es usado DES con claves criptogr\u00e1ficas embebidas para la protecci\u00f3n de determinadas credenciales del sistema, archivos de ingenier\u00eda y utilidades confidenciales."
    }
  ],
  "id": "CVE-2022-29960",
  "lastModified": "2024-11-21T07:00:04.030",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-07-26T22:15:11.007",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Not Applicable",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.forescout.com/blog/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.forescout.com/blog/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.