CVE-2022-30244

 

Published at: - 15-07-2022 02:15

Last modified: - 22-07-2022 07:05

Total changes: - 2

Description

Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be store on the controller and then run without verification. A user with malicious intent can send a crafted packet to change and/or stop the program without the knowledge of other users, altering the controller's function. After the programming change, the program needs to be overwritten in order for the controller to restore its original operational function.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.honeywell.com/us/en/product-security
• https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities
• https://blog.scadafence.com

 

Keywords

NVD

 

CVE-2022-30244

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures