CVE-2022-29960

Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities.

CVSS v3.0 5.5 MEDIUM

5.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.forescout.com/blog/	Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03	Not Applicable Third Party Advisory US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03	Third Party Advisory US Government Resource

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:emerson:openbsi:5.9:sp1::::::
	cpe:2.3:a:emerson:openbsi:5.9:sp2::::::
	cpe:2.3:a:emerson:openbsi:5.9:sp3::::::
	cpe:2.3:a:emerson:openbsi:5.9:-::::::
	cpe:2.3:a:emerson:openbsi::::::::

Information

Published : 2022-07-26 15:15

Updated : 2022-08-16 10:55

NVD link : CVE-2022-29960

Mitre link : CVE-2022-29960

JSON object : View

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

Advertisement

Products Affected

emerson

openbsi

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.forescout.com/blog/", "name": "https://www.forescout.com/blog/", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03", "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03", "tags": ["Not Applicable", "Third Party Advisory", "US Government Resource"], "refsource": "MISC"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03", "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-327"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-29960", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}}, "publishedDate": "2022-07-26T22:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:emerson:openbsi:5.9:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:emerson:openbsi:5.9:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:emerson:openbsi:5.9:sp3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:emerson:openbsi:5.9:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:emerson:openbsi:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.9"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-08-16T17:55Z"}