CVE-2022-29953

CRITICAL

Bently Nevada 3701/40, 3701/44, 3701/46, 60M100 Firmware - Use of Hard-coded Credentials in Maintenance Interface

Title source: llm

Description

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://www.forescout.com/blog/

Mitigation, Third Party Advisory, US Government Resource x_refsource_misc

https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02

Scores

CVSS v3 9.8

EPSS 0.0081

EPSS Percentile 52.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-798

Status published

Products (4)

bakerhughes/bently_nevada_3701\/40_firmware < 4.1

bakerhughes/bently_nevada_3701\/44_firmware < 4.1

bakerhughes/bently_nevada_3701\/46_firmware < 4.1

bakerhughes/bently_nevada_60m100_firmware

Published Jul 26, 2022

Tracked Since Feb 18, 2026