PT-2022-3174 · Emerson · Emerson Roc+1

Daniel Dos Santos + 1 · Published 2022-06-22 · Updated 2022-08-17 · CVE-2022-30264

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Emerson ROC and FloBoss RTU product lines through 2022-05-02

Description The issue is related to insecure filesystem operations in the Emerson ROC and FloBoss RTU product lines. These products use the ROC protocol for communications between a master terminal and RTUs, specifically via ports 4000/TCP and 5000/TCP. The protocol's Opcode 203 allows a master terminal to perform arbitrary file and directory read, write, and delete operations on the flash filesystem. This could potentially allow a remote attacker to execute arbitrary code due to insecure privilege management.

Recommendations For Emerson ROC and FloBoss RTU product lines through 2022-05-02, consider disabling the use of Opcode 203 in the ROC protocol until a secure update is available. Restrict access to the flash filesystem to minimize the risk of exploitation. Avoid using the ROC protocol for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-269

CWE-345

Related Identifiers

BDU:2022-03854

CVE-2022-30264

Affected Products

Emerson Roc

Floboss Rtu

References · 8

• https://osv.dev/vulnerability/CVE-2022-30264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30264 · Security Note
• https://bdu.fstec.ru/vul/2022-03854 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-223-04 · Note
• https://forescout.com/resources/ot-icefall-report · Note
• https://forescout.com/blog · Note
• https://csirt.gob.cl/media/2022/06/9VSA22-00666-01-1.pdf · Note
• https://t.me/cibsecurity/48217 · Telegram Post