CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-29959
https://notcve.org/view.php?id=CVE-2022-29959
Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism. Emerson OpenBSI versiones hasta 29-04-2022, maneja inapropiadamente el almacenamiento de credenciales. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03 https://www.forescout.com/blog • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-29960
https://notcve.org/view.php?id=CVE-2022-29960
Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities. Emerson OpenBSI versiones hasta 29-04-2022, usa una criptografía débil. Es un entorno de ingeniería para la línea de RTUs ControlWave y Bristol Babcock. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03 https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03 https://www.forescout.com/blog • CWE-798: Use of Hard-coded Credentials •