CVE-2022-30260
HIGHCVSS 7.8/10EPSS 0.15%
Last modified
CVE-2022-30260 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Emerson | Deltav Distributed Control System Sq Controller Firmware | < 14.3 |
| Emerson | Deltav Distributed Control System Sx Controller Firmware | < 14.3 |
| Emerson | Se4002s1t2b6 High Side 40-Pin Mass I\/O Terminal Block Firmware | < 14.3 |
| Emerson | Se4003s2b4 16-Pin Mass I\/O Terminal Block Firmware | < 14.3 |
| Emerson | Se4003s2b524-Pin Mass I\/O Terminal Block Firmware | < 14.3 |
| Emerson | Se4017p0 H1 I\/O Interface Card And Terminl Block Firmware | < 14.3 |
| Emerson | Se4017p1 H1 I\/O Card With Integrated Power Firmware | < 14.3 |
| Emerson | Se4019p0 Simplex H1 4-Port Plus Fieldbus I\/O Interface With Terminalblock Firmware | < 14.3 |
| Emerson | Se4026 Virtual I\/O Module 2 Firmware | < 14.3 |
| Emerson | Se4027 Virtual I\/O Module 2 Firmware | < 14.3 |
| Emerson | Se4032s1t2b8 High Side 40-Pin Do Mass I\/O Terminal Block Firmware | < 14.3 |
| Emerson | Se4037p0 H1 I\/O Interface Card And Terminl Block Firmware | < 14.3 |
| Emerson | Se4037p1 Redundant H1 I\/O Card With Integrated Power And Terminal Block Firmware | < 14.3 |
| Emerson | Se4039p0 Redundant H1 4-Port Plus Fieldbus I\/O Interface With Terminalblock Firmware | < 14.3 |
| Emerson | Se4052s1t2b6 High Side 40-Pin Mass I\/O Terminal Block Firmware | < 14.3 |
| Emerson | Se4082s1t2b8 High Side 40-Pin Do Mass I\/O Terminal Block Firmware | < 14.3 |
| Emerson | Se4100 Simplex Ethernet I\/O Card \(Eioc\) Assembly Firmware | < 14.3 |
| Emerson | Se4101 Simplex Ethernet I\/O Card \(Eioc\) Assembly Firmware | < 14.3 |
| Emerson | Se4801t0x Redundant Wireless I\/O Card Firmware | < 14.3 |
| Emerson | Ve4103 Modbus Tcp Interface For Ethernet Connected I\/O \(Eioc\) Firmware | < 14.3 |
| Emerson | Ve4104 Ethernet\/Ip Control Tag Integration For Ethernet Connected I\/O \(Eioc\) Firmware | < 14.3 |
| Emerson | Ve4105 Ethernet\/Ip Interface For Ethernet Connected I\/O \(Eioc\) Firmware | < 14.3 |
| Emerson | Ve4106 Opc-Ua Client For Ethernet Connected I\/O \(Eioc\) Firmware | < 14.3 |
| Emerson | Ve4107 Iec 61850 Mms Interface For Ethernet Connected I\/O \(Eioc\) Firmware | < 14.3 |
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Third Party Advisory, US Government Resource
- https://www.forescout.com/blog/Not Applicable, Third Party Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Third Party Advisory, US Government Resource
- https://www.forescout.com/blog/Not Applicable, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-30260?
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.
How severe is CVE-2022-30260?
CVE-2022-30260 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.15% probability of exploitation in the next 30 days.
How do I fix CVE-2022-30260?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-30245Honeywell Alerton Compass Software 1.6.5 allows unauthentica…6.5
- CVE-2022-3025The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 …5.4
- CVE-2022-30256An issue was discovered in MaraDNS Deadwood through 3.5.0021…7.5
- CVE-2022-30257An issue was discovered in Technitium DNS Server through 8.0…9.8
- CVE-2022-30258An issue was discovered in Technitium DNS Server through 8.0…9.8
- CVE-2022-3026The WP Users Exporter plugin for WordPress is vulnerable to …8.8
- CVE-2022-30262The Emerson ControlWave 'Next Generation' RTUs through 2022-…7.8
- CVE-2022-30264The Emerson ROC and FloBoss RTU product lines through 2022-0…9.8
- CVE-2022-30269Motorola ACE1000 RTUs through 2022-05-02 mishandle applicati…8.8
- CVE-2022-3027The CMS8000 device does not properly control or sanitize the…5.7
- CVE-2022-30270The Motorola ACE1000 RTU through 2022-05-02 has default cred…9.8
- CVE-2022-30271The Motorola ACE1000 RTU through 2022-05-02 ships with a har…9.8
Are you affected by CVE-2022-30260?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST