What is CVE-2022-30262?

CVE-2022-30262 is a high-severity vulnerability in Emerson Controlwave Micro, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.8/10. Published 2022-08-17.

How severe is CVE-2022-30262?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Emerson Controlwave Micro

CVE-2022-30262

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

EPSS: 0.002 (7.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)

Frequently asked questions

What is CVE-2022-30262?: CVE-2022-30262 is a high-severity vulnerability in Emerson Controlwave Micro, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.8/10. Published 2022-08-17.
How severe is CVE-2022-30262?: High severity. CVSS v3 base score is 7.8 out of 10.