Honeywell Safety Manager
Successful exploitation of these vulnerabilities could allow for configuration and firmware manipulation or remote code execution.
beschreibt (4)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-30316US | medium6.8OT erhöht | — | ||
Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthe… | ||||
| CVE-2022-30315US | critical9.8OT erhöht | — | ||
Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion… | ||||
| CVE-2022-30314US | medium4.6OT erhöht | — | ||
Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. T… | ||||
| CVE-2022-30313US | high7.5OT erhöht | — | ||
Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell Experion PKS Safety M… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-22-207-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-22-207-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (8)
- MitigationSafety Manager
(CVE-2022-30313) Safety builder should reside on a station with restrictive access controls. Network controls should be in place to limit the nodes permitted to communicate the builder protocol to the safety manager.
- MitigationSafety Manager
(CVE-2022-30314) Customers should isolate process control networks following our security best practices.
- MitigationSafety Manager
(CVE-2022-30315) Safety builder should reside on a station with restrictive access controls. Network controls should be in place to limit the nodes permitted to communicate the builder protocol to the safety manager.
- MitigationSafety Manager
Honeywell has identified the following specific workarounds and mitigations users can apply to reduce risk:
- BehobenSafety Manager
(CVE-2022-30313) Safety Manager and FSC use a key switch control to prevent users from downloading unauthorized safety logic. When the key switch is in the locked state, users cannot download any logic whatsoever.
- BehobenSafety Manager
(CVE-2022-30314) Safety Manager R160.1 and later releases include a remediation for this item. R160.1 was introduced in October 2014. Users are advised to operate on the latest release and point release.
https://process.honeywell.com/us/en/products/control-and-supervisory-systems/safety-systems/safety-manager - BehobenSafety Manager
(CVE-2022-30315) Safety Manager and FSC use a key switch control to prevent users from downloading unauthorized safety logic. When the key switch is in the locked state, users cannot download any logic whatsoever.
- BehobenSafety Manager
(CVE-2022-30316) The Safety Manager key switch prevents unauthorized firmware from being installed. Users are advised to monitor the key switch position.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan