PT-2022-3167 · Bristol Babcock · Bristol Babcock 33Xx

Published 2022-06-22 · Updated 2023-01-30 · CVE-2022-29956

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ControlWave and Bristol Babcock 33xx controllers (affected versions not specified)

Description The issue is related to the implementation of the BSAP/IP protocol in the controllers, which has insufficient encryption strength. This could allow a remote attacker to disclose protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2022-03847

CVE-2022-29956

DLA-3293-1

Affected Products

Bristol Babcock 33Xx

References · 4

• https://bdu.fstec.ru/vul/2022-03847 · Security Note
• https://osv.dev/vulnerability/DLA-3293-1 · Vendor Advisory
• https://forescout.com/resources/ot-icefall-report · Note
• https://csirt.gob.cl/media/2022/06/9VSA22-00666-01-1.pdf · Note