Emerson Ovation protocols lack authentication, allowing configuration changes
Industrial control equipment could have its settings taken or be stopped by attackers!
Summary
Several protocols in Emerson Ovation have no authentication, so an attacker could change controller configuration or cause a denial of service. Versions up to and including 3.8.0 Feature Pack 1 are affected.
What to do
Check that the product runs 3.8.0 Feature Pack 3 or newer, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen