Vulnerability Details : CVE-2022-30245
Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the knowledge of other users, altering the controller's function capabilities. The changed configuration is not updated in the User Interface, which creates an inconsistency between the configuration display and the actual configuration on the controller. After the configuration change, remediation requires reverting to the correct configuration, requiring either physical or remote access depending on the configuration that was altered.
Products affected by CVE-2022-30245
- cpe:2.3:a:honeywell:alerton_compass:1.6.5:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-30245
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-30245
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2022-30245
-
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-30245
-
https://blog.scadafence.com
SCADAfence BlogThird Party Advisory
-
https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities
GitHub - scadafence/Honeywell-Alerton-Vulnerabilities: Alerton Ascent Control Module (ACM) & Alerton Visual Logic vulnerabilitiesThird Party Advisory
-
https://www.honeywell.com/us/en/product-security
Access DeniedVendor Advisory
Jump to