PT-2022-3158 · Emerson · Emerson Openbsi

Daniel Dos Santos + 1 · Published 2022-06-22 · Updated 2024-02-13 · CVE-2022-29959

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Emerson OpenBSI versions prior to 2022-04-29

Description The issue is related to the insecure storage of confidential information in the SecUsers.ini file, which can be exploited by a remote attacker to gain access to user credentials. The Emerson OpenBSI environment, used for the ControlWave and Bristol Babcock line of RTUs, provides access control functionality through user authentication and privilege management. However, the credentials for various users are stored insecurely using a simple string transformation rather than a cryptographic mechanism.

Recommendations For Emerson OpenBSI versions prior to 2022-04-29, consider updating to a version that securely stores user credentials using a cryptographic mechanism. As a temporary workaround, restrict access to the SecUsers.ini file to minimize the risk of exploitation. Additionally, review and implement best practices for secure credential storage to prevent similar issues in the future.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-316

CWE-522

Related Identifiers

BDU:2022-03838

CVE-2022-29959

Affected Products

Emerson Openbsi

References · 10

• https://osv.dev/vulnerability/CVE-2022-29959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29959 · Security Note
• https://bdu.fstec.ru/vul/2022-03838 · Security Note
• https://forescout.com/resources/ot-icefall-report · Note
• https://forescout.com/blog · Note
• https://t.me/cibsecurity/48215 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-221-03 · Note
• https://t.me/cvenotify/71256 · Telegram Post
• https://csirt.gob.cl/media/2022/06/9VSA22-00666-01-1.pdf · Note
• https://t.me/cvenotify/37360 · Telegram Post