CVE-2022-30318

Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. The affected components are characterized as: SSH. The potential impact is: Remote code execution, manipulate configuration, denial of service. The Honeywell ControlEdge PLC and RTU product line exposes an SSH service on port 22/TCP. Login as root to this service is permitted and credentials for the root user are hardcoded without automatically changing them upon first commissioning. The credentials for the SSH service are hardcoded in the firmware. The credentials grant an attacker access to a root shell on the PLC/RTU, allowing for remote code execution, configuration manipulation and denial of service.

• CWE-798

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-06Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Not Applicable
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-06Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Not Applicable

Published

Aug 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30312The Trend Controls IC protocol through 2022-05-06 allows Cle…6.5
• CVE-2022-30313Honeywell Experion PKS Safety Manager through 2022-05-06 has…7.5
• CVE-2022-30314Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded C…4.6
• CVE-2022-30315Honeywell Experion PKS Safety Manager (SM and FSC) through 2…9.8
• CVE-2022-30316Honeywell Experion PKS Safety Manager 5.02 has Insufficient …6.8
• CVE-2022-30317Honeywell Experion LX through 2022-05-06 has Missing Authent…9.1
• CVE-2022-30319Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Au…8.1
• CVE-2022-3032When receiving an HTML email that contained an <code>iframe<…6.5
• CVE-2022-30320Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Br…4.3
• CVE-2022-30321go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host acce…8.6
• CVE-2022-30322go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource…8.6
• CVE-2022-30323go-getter up to 1.5.11 and 2.0.2 panicked when processing pa…8.6