CVE-2022-30244

Katalog CVE

CVSS 8.0 · High EPSS 1,5%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada honeywell alerton ascent control module firmware. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be store on the controller and then run without verification. A user with malicious intent can send a crafted packet to change and/or stop the program without the knowledge of other users, altering the controller's function. After the programming change, the program needs to be overwritten in order for the controller to restore its original operational function.

Rincian

Terbit di NVD

15 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.honeywell.com/us/en/product-security advisory vendor
• https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities advisory pihak ketiga
• https://blog.scadafence.com not applicable