A vulnerability was found in Motorola ACE1000 RTU up to 2022-05-02 and classified as critical. This issue affects an unknown code block. The manipulation with an unknown input leads to a integrity check vulnerability. Using CWE to declare the problem leads to CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

The weakness was presented 07/27/2022 as icsa-22-179-06. The advisory is shared at cisa.gov. The identification of this vulnerability is CVE-2022-30269 since 05/04/2022. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• Motorola

Name

• ACE1000 RTU

Version

• 2022-05-02

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion