CVE-2022-29952

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.

• CWE-306

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02Mitigation, Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02Mitigation, Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory

Published

Jul 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29946NATS.io NATS Server before 2.8.2 and Streaming Server before…6.3
• CVE-2022-29947Woodpecker before 0.15.1 allows XSS via build logs because w…6.1
• CVE-2022-29948Due to an insecure design, the Lepin EP-KP001 flash drive th…4.6
• CVE-2022-2995Incorrect handling of the supplementary groups in the CRI-O …7.1
• CVE-2022-29950Experian Hunter 1.16 allows remote authenticated users to mo…4.3
• CVE-2022-29951JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authenticati…9.1
• CVE-2022-29953The Bently Nevada 3700 series of condition monitoring equipm…9.8
• CVE-2022-29957The Emerson DeltaV Distributed Control System (DCS) through …7.8
• CVE-2022-29958JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data int…9.8
• CVE-2022-29959Emerson OpenBSI through 2022-04-29 mishandles credential sto…5.5
• CVE-2022-2996A flaw was found in the python-scciclient when making an HTT…7.4
• CVE-2022-29960Emerson OpenBSI through 2022-04-29 uses weak cryptography. I…5.5