CVE-2022-30267

{
  "etk_id": "ETK-2026-3418",
  "cve_id": "CVE-2022-30267",
  "display_id": "CVE-2022-30267",
  "ghsa_id": "GHSA-qg2p-82g5-qr39",
  "euvd_id": "EUVD-2022-56079",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated firmware verification in Emerson Ovation",
  "summary": "Emerson Ovation firmware verification does not authenticate firmware signatures and uses an insecure integrity check. An attacker with network access may be able to deploy malicious firmware, causing service disruption or code execution.",
  "mitigation": "Restrict network access to Ovation firmware update and management interfaces to trusted administrators and isolated management networks. No fixed version is recorded; obtain and apply Emerson guidance or updates when available.",
  "vendor": "Emerson",
  "product": "Ovation",
  "affected": [
    {
      "affected_notes": [
        ">= 0, <= Version 3.8.0 Feature Pack 1"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ovation",
      "purl": null
    }
  ],
  "cwes": [
    345
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.1485085,
  "t0_at": "2026-11-03T23:03:12.532000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T23:03:12.532000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T23:03:12.532000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30267"
    }
  }
}