{"affected":[{"defaultStatus":"unaffected","product":"Ovation","source":"CNA: icscert","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"cveId":"CVE-2022-29966","cwes":["CWE-306"],"description":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: icscert","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.3,"severity":"critical","source":"CNA: icscert","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":9.3,"severity":"critical","source":"NVD: ics-cert@hq.dhs.gov","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":9.8,"severity":"critical","source":"NVD: ics-cert@hq.dhs.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793747840353,"publishedAt":1793746859629,"references":[{"source":"CNA: icscert","tags":[],"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"},{"source":"CNA: icscert","tags":[],"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","tags":[],"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","tags":[],"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"remediation":[{"kind":"fix","source":"CNA: icscert","text":"Emerson recommends the following:\n\n\n  *  Upgrade to the currently available release of Ovation 3.8.0 Feature Pack 3 for remediation of many of the identified vulnerabilities.\n  *  Users are advised to consider the use of OCR3000 controllers, which offer an extra layer of protection that is not available to older controller models.\n  *  Deploy and configure Ovation systems and related components as described in the Cybersecurity for Ovation Systems manual (OVREF1000).  Ovation Users' Group Website (User Manuals | Reference Manuals) https://www.ovationusers.com/  (login required)\n  *  Users with questions or concerns regarding the impact of these vulnerabilities on Ovation should contact the\nOvation-CERT by email or phone (1-800-445-9723, option 3)."}],"revision":"761832c7f1ef0e03ba8230d4a2c8c7f9ab5f61fe47f931dcc378576661c75ad2","sources":[{"modifiedAt":1793746859629,"name":"CNA: icscert","retrievedAt":1793747988006,"url":"https://www.cve.org/CVERecord?id=CVE-2022-29966"},{"modifiedAt":1793747840353,"name":"NVD","retrievedAt":1793751775006,"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29966"}],"ssvc":null,"status":"published","title":"Emerson Ovation Missing Authentication for Critical Functionality","updatedAt":1793751775006}