PT-2022-3176 · Emerson · Emerson Deltav Distributed Control System

Published 2022-06-22 · Updated 2024-02-15 · CVE-2022-30260

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emerson DeltaV Distributed Control System (DCS) versions prior to 14.3

Description The issue is related to insufficient verification of firmware integrity, specifically an inadequate checksum approach and lack of signature. This could potentially allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is associated with the transmission of data in an open form.

Recommendations For versions prior to 14.3, update to version 14.3 or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to verify the integrity of firmware updates until a patch is applied. Restrict access to the system to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2022-03856

CVE-2022-30260

Affected Products

Emerson Deltav Distributed Control System

References · 9

• https://osv.dev/vulnerability/CVE-2022-30260 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03856 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-30260 · Security Note
• https://forescout.com/resources/ot-icefall-report · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-181-03 · Note
• https://forescout.com/blog · Note
• https://t.me/cvenotify/41329 · Telegram Post
• https://csirt.gob.cl/media/2022/06/9VSA22-00666-01-1.pdf · Note
• https://t.me/cvenotify/40688 · Telegram Post