---
id: "CVE-2022-30267"
kind: "vulnerability"
aliases: ["CVE-2022-30267"]
title: "Emerson Ovation: firmware updates accepted without signature checks, enabling malicious firmware"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Ovation", "fixed": ["3.8.0 Feature Pack 3"], "affected": "<= 3.8.0 Feature Pack 1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["emerson-ovation", "energy", "firmware", "industrial-control", "infrastructure", "ot-icefall"]
not_affected_if: ["isolated-network", "unknown"]
published_at: "2026-11-03T23:17:21+00:00"
first_seen_at: "2026-11-03T23:45:12+00:00"
updated_at: "2026-11-03T23:47:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30267", "first_seen_at": "2026-11-03T23:45:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T23:47:17+00:00"}]
---

# Emerson Ovation: firmware updates accepted without signature checks, enabling malicious firmware

Emerson Ovation does not authenticate firmware signing and relies on an insecure checksum for integrity, so an attacker who can reach it over the network could push a malicious firmware image to cause denial of service or remote code execution. Reported by Forescout (OT:ICEFALL). CISA reports no known public exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ovation affected <= 3.8.0 Feature Pack 1 fixed 3.8.0 Feature Pack 3

## How to check

Check your Ovation software version: 3.8.0 Feature Pack 1 or earlier is affected. Also check whether the Ovation control network is reachable from business networks or the internet, since the attack is network-based with no authentication. Emerson's guidance is in manual OVREF1000 (Ovation Users' Group login required); questions go to Ovation-CERT, 1-800-445-9723 option 3.

## Fix

Emerson (via CISA) recommends upgrading to Ovation 3.8.0 Feature Pack 3, described as remediating many of the identified vulnerabilities; the advisory does not name this CVE specifically, so confirm with Ovation-CERT. Consider OCR3000 controllers, which add a protection layer older controllers lack. Keep control networks off the internet and behind firewalls.

## Timeline

- 2026-11-03T23:45:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-30267
- 2026-11-03T23:47:17+00:00 analyst — Read CISA ICSA-24-158-02 (relays Emerson guidance; Emerson's own advisory is login-gated, so nothing marked verified). Affected: Ovation 3.8.0 FP1 and prior; FP3 upgrade per Emerson, but it says 'many' vulns fixed, not this CVE by name. CVSS v4 8.7 by CISA. No known exploitation or PoC.

## Documents

- [advisory] CISA ICSA-24-158-02 Emerson Ovation https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02

## From the sources

Emerson Ovation 
was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_