Emerson OpenBSI
Advisory ansehen veröffentlicht 2022-08-09
Successful exploitation of these vulnerabilities could cause remote code execution, change controller configuration, or cause a denial-of-service condition.
01
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-29959US | medium5.5OT erhöht | — | ||
Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides a… | ||||
| CVE-2022-29960US | medium5.5OT erhöht | — | ||
Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic k… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-22-221-03 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
Behebungen (4)
- MitigationOpenBSI
CVE-2022-29960—DES (Data Encryption Standard) with hardcoded cryptographic keys is used to protect system credentials, engineering files, and sensitive utilities.
- MitigationOpenBSI
Delete the SecUser.ini file.
- BehobenOpenBSI
Delete the UserMngtTool.exe executable from the OpenBSI folder.
- BehobenOpenBSI
Delete the UserMngtTool.exe executable from the OpenBSI folder.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan