CVE-2022-30264
Critical
Description
The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for communications between a master terminal and RTUs. Opcode 203 of this protocol allows a master terminal to transfer files to and from the flash filesystem and carrying out arbitrary file and directory read, write, and delete operations.
SeverityCritical
CVSS9.8
Exploit probability—
ProductEmerson Dl8000 Firmware
PublishedAug 16, 2022
First seenAug 16, 2022
How to fix
Update
- emerson roc809_firmware2022-05-02 or later
- emerson roc827_firmware2022-05-02 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emerson dl8000_firmware | v ≤ 2022-05-02 | — |
| emerson roc809_firmware | v < 2022-05-02 | 2022-05-02 |
| emerson roc800l_firmware | v ≤ 2022-05-02 | — |
| emerson fb3000_rtu_firmware | v ≤ 2022-05-02 | — |
| emerson roc827_firmware | v < 2022-05-02 | 2022-05-02 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.