High severity · published Dec 26, 2022
CVE-2022-30260
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature)
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Deltav Distributed Control System SQ Controller Firmware · Emerson
before 14.3 · source: NVD
DD
Deltav Distributed Control System SX Controller Firmware · Emerson
before 14.3 · source: NVD
SH
Se4002s1t2b6 High Side 40-pin Mass I/o Terminal Block Firmware · Emerson
before 14.3 · source: NVD
S1
Se4003s2b4 16-pin Mass I/o Terminal Block Firmware · Emerson
before 14.3 · source: NVD
SM
Se4003s2b524-pin Mass I/o Terminal Block Firmware · Emerson
before 14.3 · source: NVD
SH
Se4017p0 H1 I/o Interface Card And Terminl Block Firmware · Emerson
before 14.3 · source: NVD
SH
Se4017p1 H1 I/o Card With Integrated Power Firmware · Emerson
before 14.3 · source: NVD
SS
Se4019p0 Simplex H1 4-port Plus Fieldbus I/o Interface With Terminalblock Firmware · Emerson
before 14.3 · source: NVD
SV
Se4026 Virtual I/o Module 2 Firmware · Emerson
before 14.3 · source: NVD
SV
Se4027 Virtual I/o Module 2 Firmware · Emerson
before 14.3 · source: NVD
SH
Se4032s1t2b8 High Side 40-pin DO Mass I/o Terminal Block Firmware · Emerson
before 14.3 · source: NVD
SH
Se4037p0 H1 I/o Interface Card And Terminl Block Firmware · Emerson
before 14.3 · source: NVD
Affected product
DD
Deltav Distributed Control System SQ Controller Firmware
Emerson
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-30260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-30260
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
Not Applicable
https://www.forescout.com/blog/
More from Deltav Distributed Control System SQ Controller Firmware
5.5
CVE-2022-29965
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords
5.5
CVE-2022-29964
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords
5.5
CVE-2022-29963
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords
5.5
CVE-2022-29962
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords