# CVE-2022-30315: Code injection in n/a > Attackers can execute arbitrary code on Honeywell Experion PKS Safety Manager controllers via unauthenticated Safety Builder protocol downloads. - **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 28 Jul 2022 - **Updated:** 3 Aug 2024 - **Also known as:** GHSA-rqm7-h39v-q6cr ## What is CVE-2022-30315? CVE-2022-30315 is a critical code injection vulnerability in n/a, published on 28 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion PKS Safety Manager insufficient logic security controls issue. The affected components are characterized as: Honeywell FSC runtime (FSC-CPU, QPP), Honeywell Safety Builder. The potential impact is: Remote Code Execution, Denial of Service. The Honeywell Experion PKS Safety Manager family of safety controllers utilize the unauthenticated Safety Builder protocol (FSCT-2022-0051) for engineering purposes, including downloading projects and control logic to the controller. Control logic is downloaded to the controller on a block-by-block basis. The logic that is downloaded consists of FLD code compiled to native machine code for the CPU module (which applies to both the Safety Manager and FSC families). Since this logic does not seem to be cryptographically authenticated, it allows an attacker capable of triggering a logic download to execute arbitrary machine code on the controller's CPU module in the context of the runtime. While the researchers could not verify this in detail, the researchers believe that the microprocessor underpinning the FSC and Safety Manager CPU modules is incapable of offering memory protection or privilege separation capabilities which would give an attacker full control of the CPU module. There is no authentication on control logic downloaded to the controller. Memory protection and privilege separation capabilities for the runtime are possibly lacking. The researchers confirmed the issues in question on Safety Manager R145.1 and R152.2 but suspect the issue affects all FSC and SM controllers and associated Safety Builder versions regardless of software or firmware revision. An attacker who can communicate with a Safety Manager controller via the Safety Builder protocol can execute arbitrary code without restrictions on the CPU module, allowing for covert manipulation of control operations and implanting capabilities similar to the TRITON malware (MITRE ATT&CK software ID S1009). A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position. Weakness: CWE-345 (Insufficient Verification of Data Authenticity) ## Which versions are affected by CVE-2022-30315? It affects 1 product. Products: Honeywell Safety Manager Firmware. ## How do I fix CVE-2022-30315? No fix has been published for CVE-2022-30315 yet. Limit exposure of the affected software until one is available. ## Is CVE-2022-30315 being exploited? There is no known exploitation of CVE-2022-30315 in the wild and no public exploit code. ## Other vulnerabilities in n/a - [CVE-2022-30313](https://insights.sbomify.com/CVE-2022-30313/): Missing authorization in n/a (high 7.5) - [CVE-2022-30316](https://insights.sbomify.com/CVE-2022-30316/): Missing authorization in n/a (medium 6.8) - [CVE-2022-30314](https://insights.sbomify.com/CVE-2022-30314/): Hardcoded credentials in n/a (medium 4.6) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2022-30315 and fix it if it is affected. What it is: CVE-2022-30315 is a critical code injection vulnerability in n/a, published on 28 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2022-30315 in the wild and no public exploit code. Affected product: n/a. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2022-30315/ (Markdown: https://insights.sbomify.com/CVE-2022-30315/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2022-30315 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-30315 - OSV: https://osv.dev/vulnerability/CVE-2022-30315 --- From sbomify Insights: https://insights.sbomify.com/CVE-2022-30315/ Summaries are generated and may contain mistakes; the official description above is the record.