CVE-2022-30314

Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. The affected components are characterized as: POLO bootloader. The potential impact is: Manipulate firmware. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 serial interface for firmware management purposes. When booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is controlled by means of credentials hardcoded in the Safety Manager firmware. The credentials for the bootloader are hardcoded in the firmware. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize these credentials to control the boot process and manipulate the unauthenticated firmware image (see FSCT-2022-0054).
References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02 Mitigation Third Party Advisory US Government Resource
https://www.forescout.com/blog/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:honeywell:safety_manager_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:honeywell:safety_manager:-:*:*:*:*:*:*:*

History

05 Aug 2022, 22:29

Type Values Removed Values Added
First Time Honeywell safety Manager Firmware
Honeywell
Honeywell safety Manager
References (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02 - (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02 - Mitigation, Third Party Advisory, US Government Resource
References (MISC) https://www.forescout.com/blog/ - (MISC) https://www.forescout.com/blog/ - Third Party Advisory
CWE CWE-798
CPE cpe:2.3:o:honeywell:safety_manager_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:honeywell:safety_manager:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.6

28 Jul 2022, 17:28

Type Values Removed Values Added
New CVE

Information

Published : 2022-07-28 16:15

Updated : 2024-02-13 15:58


NVD link : CVE-2022-30314

Mitre link : CVE-2022-30314

CVE.ORG link : CVE-2022-30314


JSON object : View

Products Affected

honeywell

  • safety_manager_firmware
  • safety_manager
CWE
CWE-798

Use of Hard-coded Credentials