{"id":"CVE-2022-29966","kind":"vulnerability","aliases":["CVE-2022-29966"],"related":[],"title":"Emerson Ovation: unauthenticated protocols let attackers change controller configuration","description":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.","summary":"Several communication protocols in Emerson Ovation industrial control systems accept requests without any authentication. An attacker who can reach them can change controller configuration or cause a denial of service.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ovation","fixed":["3.8.0 Feature Pack 3"],"affected":"<= 3.8.0 Feature Pack 1","ecosystem":"vendor"}],"ecosystems":[],"tags":["emerson-ovation","industrial-control-systems","infrastructure","ot-icefall","scada"],"not_affected_if":["isolated-network"],"how_to_check":"Check your Ovation software version: 3.8.0 Feature Pack 1 or earlier is affected. Also check whether the Ovation control network is reachable from business networks or the internet. Emerson's cybersecurity manual OVREF1000 (Ovation Users' Group login required) covers the configuration.","fix":"Upgrade to Ovation 3.8.0 Feature Pack 3 (per Emerson via CISA). Consider OCR3000 controllers, which add a protection layer older controllers lack.","status":"open","published_at":"2026-11-03T23:17:20+00:00","first_seen_at":"2026-11-03T23:45:12+00:00","triaged_at":"2026-11-03T23:45:24+00:00","updated_at":"2026-11-03T23:46:15+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-03T23:45:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Emerson Ovation: unauthenticated protocols let attackers change controller configuration","impact":"high","summary":"Several communication protocols in Emerson Ovation industrial control systems accept requests without any authentication. An attacker who can reach them can change controller configuration or cause a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["emerson-ovation","industrial-control-systems","scada"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker changes controller configuration or halts controller operations","analyst_note":"Find the affected Ovation versions, the specific unauthenticated protocols, and Emerson's advisory with any mitigation, from the NVD entry and Emerson's security notices.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["isolated-network"],"who_is_affected":"Operators running Emerson Ovation industrial control systems where the controller protocols are reachable from networks an attacker could use. The sources do not name affected versions or the specific protocols, so the exposed systems cannot be identified from this text alone. Systems with those protocols fully isolated from untrusted networks are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000646,"input_tokens":4067,"output_tokens":479,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected Ovation versions, the specific unauthenticated protocols, and Emerson's advisory with any mitigation, from the NVD entry and Emerson's security notices.","search":"'-2022':11A,14A '-29966':12A,15A 'accept':38B 'allow':70C 'attack':6A,44B,72C 'authent':42B,67C 'caus':54B,78C 'chang':7A,50B,74C 'communic':30B 'condit':84C 'configur':9A,52B,76C 'control':8A,22B,36B,51B,75C 'could':69C 'cve':10A,13A 'denial':56B,81C 'denial-of-servic':80C 'emerson':1A,18B,33B,59C 'emerson-ov':17B 'icefal':27B 'industri':21B,35B 'industrial-control-system':20B 'infrastructur':24B 'let':5A 'ot':26B 'ot-icefal':25B 'ovat':2A,19B,34B,60C 'ovation':16A 'protocol':4A,31B,63C 'reach':47B 'request':39B 'scada':28B 'servic':58B,83C 'sever':29B,62C 'system':23B,37B 'unauthent':3A 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Emerson Ovation distributed control systems, mostly in power and energy, on version 3.8.0 Feature Pack 1 or earlier. Exposure depends on whether an attacker can reach the controllers' network protocols, which need no authentication. Teams that don't run Ovation can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ovation"],"ptokens":["ovation"],"labels":["critical","emersonovation","industrialcontrolsystems","infrastructure","oticefall","scada"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2022-29966","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29966","severity":null,"published_at":"2026-11-03T23:17:20+00:00","modified_at":"2026-11-03T23:17:20+00:00","first_seen_at":"2026-11-03T23:45:12+00:00","fetched_at":"2026-11-03T23:45:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-29966:1578","url":null,"severity":null,"published_at":"2026-11-03T23:46:15+00:00","modified_at":"2026-11-03T23:46:15+00:00","first_seen_at":"2026-11-03T23:46:15+00:00","fetched_at":"2026-11-03T23:46:15+00:00","note":"Read CISA ICSA-24-158-02 (relays Emerson's guidance; Emerson's own Ovation advisory is login-gated, so nothing marked verified). Affected: Ovation 3.8.0 FP1 and prior; fix: upgrade to 3.8.0 FP3. Specific unauthenticated protocols are not named in any public source I found. No known exploitation per CISA. Reported by Forescout (OT:ICEFALL)."}],"documents":[{"id":61700,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02","title":"CISA ICSA-24-158-02 Emerson Ovation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}