Auth bypass in Motorola Ace1000
CVE-2022-30270
The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software functionality. Access to this interface is controlled by 5 preconfigured accounts (root, abuilder, acelogin, cappl, ace), all of which come with default credentials. Although the ACE1000 documentation mentions the root, abuilder and acelogin accounts and instructs users to change the default credentials, the cappl and ace accounts remain undocumented and thus are unlikely to have their credentials changed.
Vulnerability class: Broken Authentication
EPSS: 0.009 (54.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Motorola Ace1000
- Motorola Ace1000_firmware
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC, Not Applicable)
- cve@mitre.org (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)
Frequently asked questions
- What is CVE-2022-30270?
- CVE-2022-30270 is a critical-severity vulnerability in Motorola Ace1000, classified under Improper Authentication. CVSS score: 9.8/10. Published 2022-07-26.
- How severe is CVE-2022-30270?
- Critical severity. CVSS v3 base score is 9.8 out of 10.