CVE-2022-30319

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus authentication bypass issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication functions on the basis of a MAC/IP whitelist with inactivity timeout to which an authenticated client's MAC/IP is stored. UDP traffic can be spoofed to bypass the whitelist-based access control. Since UDP is stateless, an attacker capable of passively observing traffic can spoof arbitrary messages using the MAC/IP of an authenticated client. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration.

Saia Burgess Controls (SBC) PCD versiones hasta 06-05-2022, permite una omisión de la Autenticación. De acuerdo con FSCT-2022-0062, se presenta un problema de omisión de autenticación S-Bus de Saia Burgess Controls (SBC) PCD. Los componentes afectados son caracterizados como: Autenticación S-Bus (5050/UDP). El impacto potencial es: Omisión de Autenticación. Los controladores PCD de Saia Burgess Controls (SBC) usan el protocolo S-Bus (5050/UDP) para diversos fines de ingeniería. Es posible configurar una contraseña para restringir el acceso a la funcionalidad de ingeniería confidencial. La autenticación funciona sobre la base de una lista blanca de MAC/IP con tiempo de inactividad en la que es almacenada la MAC/IP de un cliente autenticado. El tráfico UDP puede ser falsificado para omitir el control de acceso basado en la lista blanca. Como el UDP no presenta estado, un atacante capaz de observar pasivamente el tráfico puede falsificar mensajes arbitrarios usando la MAC/IP de un cliente autenticado. Esto permite al atacante acceder a funciones de ingeniería confidenciales, como la carga/descarga de la lógica de control y la manipulación de la configuración del controlador

*Credits: N/A

CVSS Scores

NISTv3.1 8.1

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-06 CVE Reserved
2022-07-28 CVE Published
2024-02-09 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-290: Authentication Bypass by Spoofing

CAPEC

References (2)

URL	Tag	Source
https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-03	Third Party Advisory
https://www.forescout.com/blog	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Honeywell Search vendor "Honeywell"		Saia Pg5 Controls Suite Search vendor "Honeywell" for product "Saia Pg5 Controls Suite"				-		-		Affected