Live › vulnerability › CVE-2022-29966
Several communication protocols in Emerson Ovation industrial control systems accept requests without any authentication. An attacker who can reach them can change controller configuration or cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Organizations that run Emerson Ovation distributed control systems, mostly in power and energy, on version 3.8.0 Feature Pack 1 or earlier. Exposure depends on whether an attacker can reach the controllers' network protocols, which need no authentication. Teams that don't run Ovation can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Ovation | vendor | <= 3.8.0 Feature Pack 1 | 3.8.0 Feature Pack 3 |
3.8.0 Feature Pack 1 or earlier is affecteds cybersecurity manual OVREF1000 (Ovation Users Group login required) covers the configuration3.8.0 Feature Pack 3 (per Emerson via CISA)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.
This page as .md · .json · in your agent: get_signal("CVE-2022-29966")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.