CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2333 – Honeywell SoftMaster Uncontrolled Search Path Element
https://notcve.org/view.php?id=CVE-2022-2333
If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4.51 application’s context and permissions. Si un atacante logra engañar a un usuario válido para que cargue una DLL maliciosa, el atacante puede lograr la ejecución de código en el contexto y los permisos de la aplicación Honeywell SoftMaster versión 4.51 • https://github.com/shirouQwQ/CVE-2022-2333 https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-02 https://www.security.honeywell.com/-/media/Security/Resources/PDF/Product-Warranty/Security_Notification_SN_2019-09-13-02_V4-pdf.pdf • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2022-30312
https://notcve.org/view.php?id=CVE-2022-30312
The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Controls Inter-Controller (IC) protocol cleartext transmission of credentials issue. The affected components are characterized as: Inter-Controller (IC) protocol (57612/UDP). The potential impact is: Compromise of credentials. Several Trend Controls building automation controllers utilize the Inter-Controller (IC) protocol in for information exchange and automation purposes. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-08 https://www.forescout.com/blog • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-30318
https://notcve.org/view.php?id=CVE-2022-30318
Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. The affected components are characterized as: SSH. The potential impact is: Remote code execution, manipulate configuration, denial of service. The Honeywell ControlEdge PLC and RTU product line exposes an SSH service on port 22/TCP. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-06 https://www.forescout.com/blog • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-30317
https://notcve.org/view.php?id=CVE-2022-30317
Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Control Data Access (CDA) EpicMo protocol with unauthenticated functionality issue. The affected components are characterized as: Honeywell Control Data Access (CDA) EpicMo (55565/TCP). The potential impact is: Firmware manipulation, Denial of service. The Honeywell Experion LX Distributed Control System (DCS) utilizes the Control Data Access (CDA) EpicMo protocol (55565/TCP) for device diagnostics and maintenance purposes. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-07 https://www.forescout.com/blog • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30319
https://notcve.org/view.php?id=CVE-2022-30319
Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus authentication bypass issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03 https://www.forescout.com/blog • CWE-290: Authentication Bypass by Spoofing •