High severity · published Jul 26, 2022
CVE-2022-30272
The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access to the Web UI where file system, kernel, package, bundle, or application images can be installed. Firmware updates for the Front End Processor (FEP) module are performed via access to the SSH interface (22/TCP), where a .hex file image is transferred and a bootloader script invoked. File system, kernel, package, and bundle updates are supplied as RPM (RPM Package Manager) files while FEP updates are supplied as S-rec files. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ace1000 Firmware · Motorola
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-30272
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-30272
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
Not Applicable
https://www.forescout.com/blog/
More from Ace1000 Firmware
9.8
CVE-2022-30274
The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely
9.8
CVE-2022-30271
The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no…
9.8
CVE-2022-30270
The Motorola ACE1000 RTU through 2022-05-02 has default credentials
8.8
CVE-2022-30269
Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity