CVE-2022-30272

The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access to the Web UI where file system, kernel, package, bundle, or application images can be installed. Firmware updates for the Front End Processor (FEP) module are performed via access to the SSH interface (22/TCP), where a .hex file image is transferred and a bootloader script invoked. File system, kernel, package, and bundle updates are supplied as RPM (RPM Package Manager) files while FEP updates are supplied as S-rec files. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

• CWE-345

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06Mitigation, Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Not Applicable
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06Mitigation, Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Not Applicable

Published

Jul 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30262The Emerson ControlWave 'Next Generation' RTUs through 2022-…7.8
• CVE-2022-30264The Emerson ROC and FloBoss RTU product lines through 2022-0…9.8
• CVE-2022-30269Motorola ACE1000 RTUs through 2022-05-02 mishandle applicati…8.8
• CVE-2022-3027The CMS8000 device does not properly control or sanitize the…5.7
• CVE-2022-30270The Motorola ACE1000 RTU through 2022-05-02 has default cred…9.8
• CVE-2022-30271The Motorola ACE1000 RTU through 2022-05-02 ships with a har…9.8
• CVE-2022-30273The Motorola MDLC protocol through 2022-05-02 mishandles mes…9.8
• CVE-2022-30274The Motorola ACE1000 RTU through 2022-05-02 uses ECB encrypt…9.8
• CVE-2022-30275The Motorola MOSCAD Toolbox software through 2022-05-02 reli…7.5
• CVE-2022-30276The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 …7.5
• CVE-2022-30277BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an …5.7
• CVE-2022-30278A vulnerability in Black Duck Hub’s embedded MadCap Flare do…6.1