CyberSecBulletin
CVE-2022-30260NVD status: Modified

Deltav Distributed Control System Sq…: Insufficient Verification of Data Authenticity

Published Updated By the CyberSecBulletin desk

CVE-2022-30260 is a high-severity insufficient verification of data authenticity vulnerability in Deltav Distributed Control System Sq Controller Firmware from Emerson, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists version 14.3 as the first without the flaw, so updating Deltav Distributed Control System Sq Controller Firmware to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Deltav Distributed Control System Sq Controller Firmware to 14.3 or a later version.
  2. Update Deltav Distributed Control System Sx Controller Firmware to 14.3 or a later version.
  3. Update Se4002s1t2b6 High Side 40-pin Mass I/o Terminal Block Firmware to 14.3 or a later version.
  4. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
EmersonDeltav Distributed Control System Sq Controller Firmwarebefore 14.314.3
EmersonDeltav Distributed Control System Sx Controller Firmwarebefore 14.314.3
EmersonSe4002s1t2b6 High Side 40-pin Mass I/o Terminal Block Firmwarebefore 14.314.3
EmersonSe4003s2b4 16-pin Mass I/o Terminal Block Firmwarebefore 14.314.3
EmersonSe4003s2b524-pin Mass I/o Terminal Block Firmwarebefore 14.314.3
EmersonSe4017p0 H1 I/o Interface Card And Terminl Block Firmwarebefore 14.314.3
EmersonSe4017p1 H1 I/o Card With Integrated Power Firmwarebefore 14.314.3
EmersonSe4019p0 Simplex H1 4-port Plus Fieldbus I/o Interface With Terminalblock Firmwarebefore 14.314.3
EmersonSe4026 Virtual I/o Module 2 Firmwarebefore 14.314.3
EmersonSe4027 Virtual I/o Module 2 Firmwarebefore 14.314.3
EmersonSe4032s1t2b8 High Side 40-pin Do Mass I/o Terminal Block Firmwarebefore 14.314.3
EmersonSe4037p0 H1 I/o Interface Card And Terminl Block Firmwarebefore 14.314.3
EmersonSe4037p1 Redundant H1 I/o Card With Integrated Power And Terminal Block Firmwarebefore 14.314.3
EmersonSe4039p0 Redundant H1 4-port Plus Fieldbus I/o Interface With Terminalblock Firmwarebefore 14.314.3
EmersonSe4052s1t2b6 High Side 40-pin Mass I/o Terminal Block Firmwarebefore 14.314.3
EmersonSe4082s1t2b8 High Side 40-pin Do Mass I/o Terminal Block Firmwarebefore 14.314.3
EmersonSe4100 Simplex Ethernet I/o Card (eioc) Assembly Firmwarebefore 14.314.3
EmersonSe4101 Simplex Ethernet I/o Card (eioc) Assembly Firmwarebefore 14.314.3
EmersonSe4801t0x Redundant Wireless I/o Card Firmwarebefore 14.314.3
EmersonVe4103 Modbus Tcp Interface For Ethernet Connected I/o (eioc) Firmwarebefore 14.314.3
EmersonVe4104 Ethernet/ip Control Tag Integration For Ethernet Connected I/o (eioc) Firmwarebefore 14.314.3
EmersonVe4105 Ethernet/ip Interface For Ethernet Connected I/o (eioc) Firmwarebefore 14.314.3
EmersonVe4106 Opc-ua Client For Ethernet Connected I/o (eioc) Firmwarebefore 14.314.3
EmersonVe4107 Iec 61850 Mms Interface For Ethernet Connected I/o (eioc) Firmwarebefore 14.314.3

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

More Insufficient Verification of Data Authenticity vulnerabilities (CWE-345)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Insufficient Verification of Data Authenticity vulnerabilities

Spotted an error? Tell us.