Honeywell Saia Burgess PG5 PCD up to 2022-05-06 authentication bypass

Summaryinfo

A vulnerability was found in Honeywell Saia Burgess PG5 PCD up to 2022-05-06. It has been declared as critical. The affected element is an unknown function. Executing a manipulation can lead to authentication bypass. This vulnerability appears as CVE-2022-30319. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Honeywell Saia Burgess PG5 PCD up to 2022-05-06. It has been declared as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a authentication bypass vulnerability. The CWE definition for the vulnerability is CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus authentication bypass issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication functions on the basis of a MAC/IP whitelist with inactivity timeout to which an authenticated client's MAC/IP is stored. UDP traffic can be spoofed to bypass the whitelist-based access control. Since UDP is stateless, an attacker capable of passively observing traffic can spoof arbitrary messages using the MAC/IP of an authenticated client. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration.

The weakness was presented 07/29/2022 as icsa-22-207-03. The advisory is shared for download at cisa.gov. This vulnerability was named CVE-2022-30319 since 05/06/2022. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Honeywell

Name

• Saia Burgess PG5 PCD

Version

• 2022-05-06

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion