Honeywell Safety Manager
Successful exploitation of these vulnerabilities could allow for configuration and firmware manipulation or remote code execution.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-30316US | medium6.8OT elevated | — | ||
Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthe… | ||||
| CVE-2022-30315US | critical9.8OT elevated | — | ||
Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion… | ||||
| CVE-2022-30314US | medium4.6OT elevated | — | ||
Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. T… | ||||
| CVE-2022-30313US | high7.5OT elevated | — | ||
Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell Experion PKS Safety M… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-22-207-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-22-207-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (8)
- MitigationSafety Manager
(CVE-2022-30313) Safety builder should reside on a station with restrictive access controls. Network controls should be in place to limit the nodes permitted to communicate the builder protocol to the safety manager.
- MitigationSafety Manager
(CVE-2022-30314) Customers should isolate process control networks following our security best practices.
- MitigationSafety Manager
(CVE-2022-30315) Safety builder should reside on a station with restrictive access controls. Network controls should be in place to limit the nodes permitted to communicate the builder protocol to the safety manager.
- MitigationSafety Manager
Honeywell has identified the following specific workarounds and mitigations users can apply to reduce risk:
- FixedSafety Manager
(CVE-2022-30313) Safety Manager and FSC use a key switch control to prevent users from downloading unauthorized safety logic. When the key switch is in the locked state, users cannot download any logic whatsoever.
- FixedSafety Manager
(CVE-2022-30314) Safety Manager R160.1 and later releases include a remediation for this item. R160.1 was introduced in October 2014. Users are advised to operate on the latest release and point release.
https://process.honeywell.com/us/en/products/control-and-supervisory-systems/safety-systems/safety-manager - FixedSafety Manager
(CVE-2022-30315) Safety Manager and FSC use a key switch control to prevent users from downloading unauthorized safety logic. When the key switch is in the locked state, users cannot download any logic whatsoever.
- FixedSafety Manager
(CVE-2022-30316) The Safety Manager key switch prevents unauthorized firmware from being installed. Users are advised to monitor the key switch position.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan