CVE-2022-30312

The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Controls Inter-Controller (IC) protocol cleartext transmission of credentials issue. The affected components are characterized as: Inter-Controller (IC) protocol (57612/UDP). The potential impact is: Compromise of credentials. Several Trend Controls building automation controllers utilize the Inter-Controller (IC) protocol in for information exchange and automation purposes. This protocol offers authentication in the form of a 4-digit PIN in order to protect access to sensitive operations like strategy uploads and downloads as well as optional 0-30 character username and password protection for web page access protection. Both the PIN and usernames and passwords are transmitted in cleartext, allowing an attacker with passive interception capabilities to obtain these credentials. Credentials are transmitted in cleartext. An attacker who obtains Trend IC credentials can carry out sensitive engineering actions such as manipulating controller strategy or configuration settings. If the credentials in question are (re)used for other applications, their compromise could potentially facilitate lateral movement.

• CWE-319
• CWE-319

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-08Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-08Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory

Published

Sep 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30307A key management error vulnerability [CWE-320] affecting the…8.1
• CVE-2022-30308In Festo Controller CECC-X-M1 product family in multiple ver…9.8
• CVE-2022-30309In Festo Controller CECC-X-M1 product family in multiple ver…9.8
• CVE-2022-3031An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2022-30310In Festo Controller CECC-X-M1 product family in multiple ver…9.8
• CVE-2022-30311In Festo Controller CECC-X-M1 product family in multiple ver…9.8
• CVE-2022-30313Honeywell Experion PKS Safety Manager through 2022-05-06 has…7.5
• CVE-2022-30314Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded C…4.6
• CVE-2022-30315Honeywell Experion PKS Safety Manager (SM and FSC) through 2…9.8
• CVE-2022-30316Honeywell Experion PKS Safety Manager 5.02 has Insufficient …6.8
• CVE-2022-30317Honeywell Experion LX through 2022-05-06 has Missing Authent…9.1
• CVE-2022-30318Honeywell ControlEdge through R151.1 uses Hard-coded Credent…9.8