Critical severity · published Jul 26, 2022
CVE-2022-30274
The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm (TEA) in ECB mode using a hardcoded key. Similarly, the ACE1000 RTU can route MDLC traffic over Extended Command and Management Protocol (XCMP) and Network Layer (XNL) networks via the MDLC driver. Authentication to the XNL port is protected by TEA in ECB mode using a hardcoded key.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ace1000 Firmware · Motorola
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-30274
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-30274
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
Not Applicable
https://www.forescout.com/blog/
More from Ace1000 Firmware
9.8
CVE-2022-30271
The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no…
9.8
CVE-2022-30270
The Motorola ACE1000 RTU through 2022-05-02 has default credentials
8.8
CVE-2022-30269
Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity
7.2
CVE-2022-30272
The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity