{"id":"CVE-2022-30267","kind":"vulnerability","aliases":["CVE-2022-30267"],"related":[],"title":"Emerson Ovation: firmware updates accepted without signature checks, enabling malicious firmware","description":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.","summary":"Emerson Ovation does not authenticate firmware signing and relies on an insecure checksum for integrity, so an attacker who can reach it over the network could push a malicious firmware image to cause denial of service or remote code execution. Reported by Forescout (OT:ICEFALL). CISA reports no known public exploitation.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ovation","fixed":["3.8.0 Feature Pack 3"],"affected":"<= 3.8.0 Feature Pack 1","ecosystem":"vendor"}],"ecosystems":[],"tags":["emerson-ovation","energy","firmware","industrial-control","infrastructure","ot-icefall"],"not_affected_if":["isolated-network","unknown"],"how_to_check":"Check your Ovation software version: 3.8.0 Feature Pack 1 or earlier is affected. Also check whether the Ovation control network is reachable from business networks or the internet, since the attack is network-based with no authentication. Emerson's guidance is in manual OVREF1000 (Ovation Users' Group login required); questions go to Ovation-CERT, 1-800-445-9723 option 3.","fix":"Emerson (via CISA) recommends upgrading to Ovation 3.8.0 Feature Pack 3, described as remediating many of the identified vulnerabilities; the advisory does not name this CVE specifically, so confirm with Ovation-CERT. Consider OCR3000 controllers, which add a protection layer older controllers lack. Keep control networks off the internet and behind firewalls.","status":"open","published_at":"2026-11-03T23:17:21+00:00","first_seen_at":"2026-11-03T23:45:12+00:00","triaged_at":"2026-11-03T23:45:24+00:00","updated_at":"2026-11-03T23:47:17+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-03T23:45:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Emerson Ovation: firmware updates accepted without signature checks, enabling malicious firmware","impact":"high","summary":"Emerson Ovation industrial control systems do not authenticate firmware signatures and rely on a weak checksum for integrity. An attacker could push a malicious firmware image that causes denial of service or remote code execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["emerson-ovation","industrial-control","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Malicious firmware runs on the controller, enabling code execution or denial of service.","analyst_note":"Find the Emerson advisory for Ovation affected versions, the firmware update path, and any vendor fix or mitigation; the NVD entry alone gives no ranges or checks.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Emerson Ovation controllers in industrial or process control environments. Sources do not list affected versions or a specific configuration that exposes the firmware update path, so teams should confirm with the vendor whether their Ovation deployment uses the affected firmware mechanism.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000658,"input_tokens":4104,"output_tokens":495,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Emerson advisory for Ovation affected versions, the firmware update path, and any vendor fix or mitigation; the NVD entry alone gives no ranges or checks.","search":"'-2022':13A,16A '-30267':14A,17A 'accept':5A 'achiev':119C 'allow':103C 'attack':48B,105C 'authent':35B,89C 'caus':63B,111C 'check':8A 'checksum':43B,98C 'cisa':76B 'code':69B,121C 'condit':117C 'control':26B 'could':56B,102C 'cve':12A,15A 'denial':64B,114C 'denial-of-servic':113C 'emerson':1A,20B,31B,82C 'emerson-ov':19B 'enabl':9A 'energi':22B 'execut':70B,122C 'exploit':81B 'firmwar':3A,11A,23B,36B,60B,91C,109C 'forescout':73B 'found':85C 'icefal':30B,75B 'imag':61B,110C 'industri':25B 'industrial-control':24B 'infrastructur':27B 'insecur':42B,97C 'integr':45B,100C 'known':79B 'malici':10A,59B,108C 'network':55B 'ot':29B,74B 'ot-icefal':28B 'ovat':2A,21B,32B,83C 'ovation':18A 'public':80B 'push':57B,107C 'reach':51B 'reli':39B,94C 'remot':68B,120C 'report':71B,77B 'servic':66B,116C 'sign':37B,92C 'signatur':7A 'updat':4A 'without':6A","nicknames":[],"mitigations":[],"who_affected":"Organizations running Emerson Ovation control systems, mostly in the energy sector, on version 3.8.0 Feature Pack 1 or earlier. Exposure depends on whether an attacker can reach the controllers over the network. Teams that don't run Ovation, or whose control networks are isolated from business networks and the internet, are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ovation"],"ptokens":["ovation"],"labels":["emersonovation","energy","firmware","high","industrialcontrol","infrastructure","oticefall"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2022-30267","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30267","severity":null,"published_at":"2026-11-03T23:17:21+00:00","modified_at":"2026-11-03T23:17:21+00:00","first_seen_at":"2026-11-03T23:45:12+00:00","fetched_at":"2026-11-03T23:45:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-30267:1584","url":null,"severity":null,"published_at":"2026-11-03T23:47:17+00:00","modified_at":"2026-11-03T23:47:17+00:00","first_seen_at":"2026-11-03T23:47:17+00:00","fetched_at":"2026-11-03T23:47:17+00:00","note":"Read CISA ICSA-24-158-02 (relays Emerson guidance; Emerson's own advisory is login-gated, so nothing marked verified). Affected: Ovation 3.8.0 FP1 and prior; FP3 upgrade per Emerson, but it says 'many' vulns fixed, not this CVE by name. CVSS v4 8.7 by CISA. No known exploitation or PoC."}],"documents":[{"id":61700,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02","title":"CISA ICSA-24-158-02 Emerson Ovation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}