Emerson Ovation accepts unsigned firmware with weak checksum
Attackers could push fake updates into factory control equipment.
Summary
Emerson Ovation control systems do not verify firmware signatures and rely on an insecure checksum for integrity. An attacker could push malicious firmware, stop the service, or run remote code.
What to do
Check that your Ovation version is newer than 3.8.0 Feature Pack 1, and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen