CVE-2022-30320

Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-2022-0063, there is a Saia Burgess Controls (SBC) PCD S-Bus weak credential hashing scheme issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication is done by using the S-Bus 'write byte' message to a specific address and supplying a hashed version of the password. The hashing algorithm used is based on CRC-16 and as such not cryptographically secure. An insecure hashing algorithm is used. An attacker capable of passively observing traffic can intercept the hashed credentials and trivially find collisions allowing for authentication without having to bruteforce a keyspace defined by the actual strength of the password. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration.

• CWE-327

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Not Applicable, Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Not Applicable, Third Party Advisory

Published

Jul 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30315Honeywell Experion PKS Safety Manager (SM and FSC) through 2…9.8
• CVE-2022-30316Honeywell Experion PKS Safety Manager 5.02 has Insufficient …6.8
• CVE-2022-30317Honeywell Experion LX through 2022-05-06 has Missing Authent…9.1
• CVE-2022-30318Honeywell ControlEdge through R151.1 uses Hard-coded Credent…9.8
• CVE-2022-30319Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Au…8.1
• CVE-2022-3032When receiving an HTML email that contained an <code>iframe<…6.5
• CVE-2022-30321go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host acce…8.6
• CVE-2022-30322go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource…8.6
• CVE-2022-30323go-getter up to 1.5.11 and 2.0.2 panicked when processing pa…8.6
• CVE-2022-30324HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3…9.8
• CVE-2022-30325An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 …8.8
• CVE-2022-30326An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 …5.4