Vulnerability · Published Aug 16, 2022 · Assigned by mitre
CVE-2022-30264
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for communications between a master terminal and RTUs. Opcode 203 of this protocol allows a master terminal to transfer files to and from the flash filesystem and carrying out arbitrary file and directory read, write, and delete operations.
Affected products (as reported)
References
- https://www.forescout.com/blog/ x_refsource_MISC
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-223-04 x_refsource_MISC