{"id":"CVE-2022-29966","published":"2026-11-03T23:17:20.353","lastModified":"2026-11-03T23:17:20.353","description":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json","tags":[]}],"hasPoc":true,"ai":{"summary":"The Emerson Ovation system exposes several protocols without authentication, allowing unauthenticated remote attackers to modify controller configurations or trigger denial-of-service conditions.","exploitability":"Exploitation is trivial for an attacker with network access to the affected systems, as no authentication is required.","blast_radius":"Successful exploitation could lead to full compromise of operational technology (OT) systems, including unauthorized control changes or plant shutdowns.","remediation":"Apply Emerson security advisory SA-71324 Rev. 1.0, which recommends enabling authentication on all exposed protocols and restricting network access via firewall rules; no fixed software version is specified in the CVE description.","detection":"Look for unauthenticated protocol traffic to Ovation controller endpoints (e.g., Modbus/TCP, DNP3 over TCP) from unexpected source IPs or atypical times; no specific log fields are documented in the CVE description.","tags":["auth-bypass","ics","remote-exploit","dos","no-auth"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:49:02.846Z"}}