CVE-2022-30260 Security feature bypass in n/a
Attackers can bypass firmware integrity checks in Emerson DeltaV systems to execute malicious code due to inadequate checksums and missing signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-30260?
CVE-2022-30260 is a high-severity vulnerability in n/a, published on 26 Dec 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.
Weakness: CWE-345
Which versions are affected by CVE-2022-30260?
It affects 24 products.
Products include Emerson Deltav Distributed Control System Sq Controller Firmware, Emerson Deltav Distributed Control System Sx Controller Firmware, Emerson Se4002s1t2b6 High Side 40-Pin Mass I\/O Terminal Block Firmware, Emerson Se4003s2b4 16-Pin Mass I\/O Terminal Block Firmware, Emerson Se4003s2b524-Pin Mass I\/O Terminal Block Firmware, Emerson Se4017p0 H1 I\/O Interface Card and Terminl Block Firmware and 18 more.
How do I fix CVE-2022-30260?
No fix has been published for CVE-2022-30260 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-30260 being exploited?
There is no known exploitation of CVE-2022-30260 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xc7c-c2g3-58v4.