Emerson DeltaV Distributed Control System
Several protocols, including Firmware upgrade, Plug-and-Play, Hawk services, Management, SIS communications, and multi-cast have no authentication. This could allow an attacker who has reverse-engineered communications to invoke desired functionality or cause a denial-of-service condition.CVE-2022-29957 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H). The affected product is vulnerable by using hard-coded credentials in the FTP service, which is disabled by default.CVE-2022-29962 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L). The affected product is vulnerable to hard-coded credential use within the read-only Telnet service.CVE-2022-29963 has been assigned to this vulnerability. A CVSS v3 base score of 1.8 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N). The affected product is vulnerable to hard-coded credential use within the SSH service, which is disabled by default.CVE-2022-29964 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L). Firmware images are not signed and rely on insecure checksums for regular integrity checks. This could allow an attacker to push malicious firmware images, execute code, or cause a denial-of-service condition.CVE-2022-30260 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). Access to privileged operations in the maintenance interface is controlled by a challenge-response authentication that uses a deterministic insecure algorithm.CVE-2022-29965 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).