---
id: "CVE-2022-29966"
kind: "vulnerability"
aliases: ["CVE-2022-29966"]
title: "Emerson Ovation: unauthenticated protocols let attackers change controller configuration"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Ovation", "fixed": ["3.8.0 Feature Pack 3"], "affected": "<= 3.8.0 Feature Pack 1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["emerson-ovation", "industrial-control-systems", "infrastructure", "ot-icefall", "scada"]
not_affected_if: ["isolated-network"]
published_at: "2026-11-03T23:17:20+00:00"
first_seen_at: "2026-11-03T23:45:12+00:00"
updated_at: "2026-11-03T23:46:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29966", "first_seen_at": "2026-11-03T23:45:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:46:15+00:00"}]
---

# Emerson Ovation: unauthenticated protocols let attackers change controller configuration

Several communication protocols in Emerson Ovation industrial control systems accept requests without any authentication. An attacker who can reach them can change controller configuration or cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ovation affected <= 3.8.0 Feature Pack 1 fixed 3.8.0 Feature Pack 3

## How to check

Check your Ovation software version: 3.8.0 Feature Pack 1 or earlier is affected. Also check whether the Ovation control network is reachable from business networks or the internet. Emerson's cybersecurity manual OVREF1000 (Ovation Users' Group login required) covers the configuration.

## Fix

Upgrade to Ovation 3.8.0 Feature Pack 3 (per Emerson via CISA). Consider OCR3000 controllers, which add a protection layer older controllers lack.

## Timeline

- 2026-11-03T23:45:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-29966
- 2026-11-03T23:46:15+00:00 analyst — Read CISA ICSA-24-158-02 (relays Emerson's guidance; Emerson's own Ovation advisory is login-gated, so nothing marked verified). Affected: Ovation 3.8.0 FP1 and prior; fix: upgrade to 3.8.0 FP3. Specific unauthenticated protocols are not named in any public source I found. No known exploitation per CISA. Reported by Forescout (OT:ICEFALL).

## Documents

- [advisory] CISA ICSA-24-158-02 Emerson Ovation https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02

## From the sources

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_