CVE-2022-30269

HIGH

Motorola ACE1000 RTUs through 2022-05-02 - Insufficient Verification of Data Authenticity

Title source: llm

Description

Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

References (2)

Core 2

Core References

Not Applicable x_refsource_misc

https://www.forescout.com/blog/

Mitigation, Third Party Advisory, US Government Resource x_refsource_misc

https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06

Scores

CVSS v3 8.8

EPSS 0.0037

EPSS Percentile 29.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-345

Status published

Products (1)

motorola/ace1000_firmware

Published Jul 26, 2022

Tracked Since Feb 18, 2026