Vulnerability · Published Jul 26, 2022 · Assigned by mitre

CVE-2022-30273

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)0.4%top 61.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.forescout.com/blog/ x_refsource_MISC
https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation x_refsource_MISC
https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05 x_refsource_MISC