CVE-2022-30314

Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. The affected components are characterized as: POLO bootloader. The potential impact is: Manipulate firmware. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 serial interface for firmware management purposes. When booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is controlled by means of credentials hardcoded in the Safety Manager firmware. The credentials for the bootloader are hardcoded in the firmware. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize these credentials to control the boot process and manipulate the unauthenticated firmware image (see FSCT-2022-0054).

• CWE-798

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02Mitigation, Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02Mitigation, Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory

Published

Jul 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30309In Festo Controller CECC-X-M1 product family in multiple ver…9.8
• CVE-2022-3031An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2022-30310In Festo Controller CECC-X-M1 product family in multiple ver…9.8
• CVE-2022-30311In Festo Controller CECC-X-M1 product family in multiple ver…9.8
• CVE-2022-30312The Trend Controls IC protocol through 2022-05-06 allows Cle…6.5
• CVE-2022-30313Honeywell Experion PKS Safety Manager through 2022-05-06 has…7.5
• CVE-2022-30315Honeywell Experion PKS Safety Manager (SM and FSC) through 2…9.8
• CVE-2022-30316Honeywell Experion PKS Safety Manager 5.02 has Insufficient …6.8
• CVE-2022-30317Honeywell Experion LX through 2022-05-06 has Missing Authent…9.1
• CVE-2022-30318Honeywell ControlEdge through R151.1 uses Hard-coded Credent…9.8
• CVE-2022-30319Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Au…8.1
• CVE-2022-3032When receiving an HTML email that contained an <code>iframe<…6.5