{"affected":[{"defaultStatus":"unaffected","product":"Ovation","source":"CNA: icscert","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"cveId":"CVE-2022-30267","cwes":["CWE-345"],"description":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: icscert","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":8.7,"severity":"high","source":"CNA: icscert","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.7,"severity":"high","source":"NVD: ics-cert@hq.dhs.gov","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":7.5,"severity":"high","source":"NVD: ics-cert@hq.dhs.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793747841860,"publishedAt":1793746992532,"references":[{"source":"CNA: icscert","tags":[],"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"},{"source":"CNA: icscert","tags":[],"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","tags":[],"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","tags":[],"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"remediation":[{"kind":"fix","source":"CNA: icscert","text":"Emerson recommends the following:\n\n\n  *  Upgrade to the currently available release of Ovation 3.8.0 Feature Pack 3 for remediation of many of the identified vulnerabilities.\n  *  Users are advised to consider the use of OCR3000 controllers, which offer an extra layer of protection that is not available to older controller models.\n  *  Deploy and configure Ovation systems and related components as described in the Cybersecurity for Ovation Systems manual (OVREF1000).  Ovation Users' Group Website (User Manuals | Reference Manuals) https://www.ovationusers.com/  (login required)\n  *  Users with questions or concerns regarding the impact of these vulnerabilities on Ovation should contact the\nOvation-CERT by email or phone (1-800-445-9723, option 3)."}],"revision":"635611290d83f84b0c882e9c798ceb0f057f1f93e06c1b4bf76af91b8f08d1b8","sources":[{"modifiedAt":1793746992532,"name":"CNA: icscert","retrievedAt":1793747989122,"url":"https://www.cve.org/CVERecord?id=CVE-2022-30267"},{"modifiedAt":1793747841860,"name":"NVD","retrievedAt":1793751775153,"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30267"}],"ssvc":null,"status":"published","title":"Emerson Ovation Insufficient Verification of Data Authenticity","updatedAt":1793751775153}