PT-2022-3164 · Bristol Babcock · Bristol Babcock 33Xx

Published 2022-06-22 · Updated 2022-06-22 · CVE-2022-29961

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ControlWave and Bristol Babcock 33xx controllers (affected versions not specified)

Description The issue is related to the implementation of the BSAP/IP protocol in the controllers, which uses flawed cryptographic algorithms. This could allow a remote attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Inadequate Encryption Strength

Weakness Enumeration

CWE-327

CWE-326

Related Identifiers

BDU:2022-03844

CVE-2022-29961

Affected Products

Bristol Babcock 33Xx

References · 3

• https://bdu.fstec.ru/vul/2022-03844 · Security Note
• https://forescout.com/resources/ot-icefall-report · Note
• https://csirt.gob.cl/media/2022/06/9VSA22-00666-01-1.pdf · Note