The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for communications between a master terminal and RTUs. Opcode 203 of this protocol allows a master terminal to transfer files to and from the flash filesystem and carrying out arbitrary file and directory read, write, and delete operations.
References
Link | Resource |
---|---|
https://www.cisa.gov/uscert/ics/advisories/icsa-22-223-04 | Mitigation Third Party Advisory US Government Resource |
https://www.forescout.com/blog/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
AND |
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
History
17 Aug 2022, 19:35
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-345 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
References | (MISC) https://www.forescout.com/blog/ - Third Party Advisory | |
References | (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-223-04 - Mitigation, Third Party Advisory, US Government Resource | |
CPE | cpe:2.3:h:emerson:roc809:-:*:*:*:*:*:*:* cpe:2.3:h:emerson:roc800l:-:*:*:*:*:*:*:* cpe:2.3:h:emerson:roc827:-:*:*:*:*:*:*:* cpe:2.3:o:emerson:fb3000_rtu_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:emerson:roc800l_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:emerson:dl8000:-:*:*:*:*:*:*:* cpe:2.3:o:emerson:roc809_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:emerson:dl8000_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:emerson:roc827_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:emerson:fb3000_rtu:-:*:*:*:*:*:*:* |
|
First Time |
Emerson dl8000 Firmware
Emerson roc827 Emerson roc800l Firmware Emerson dl8000 Emerson roc809 Emerson roc800l Emerson Emerson roc827 Firmware Emerson fb3000 Rtu Emerson roc809 Firmware Emerson fb3000 Rtu Firmware |
16 Aug 2022, 13:46
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-08-16 13:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-30264
Mitre link : CVE-2022-30264
CVE.ORG link : CVE-2022-30264
JSON object : View
Products Affected
emerson
- roc809
- roc800l
- fb3000_rtu_firmware
- roc827_firmware
- dl8000_firmware
- dl8000
- roc800l_firmware
- fb3000_rtu
- roc827
- roc809_firmware
CWE
CWE-345
Insufficient Verification of Data Authenticity