The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02 | Mitigation Third Party Advisory US Government Resource |
| https://www.forescout.com/blog/ | Third Party Advisory |
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02 | Mitigation Third Party Advisory US Government Resource |
| https://www.forescout.com/blog/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
21 Nov 2024, 07:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02 - Mitigation, Third Party Advisory, US Government Resource | |
| References | () https://www.forescout.com/blog/ - Third Party Advisory |
Information
Published : 2022-07-26 22:15
Updated : 2024-11-21 07:00
NVD link : CVE-2022-29953
Mitre link : CVE-2022-29953
CVE.ORG link : CVE-2022-29953
JSON object : View
Products Affected
bakerhughes
- bently_nevada_3701\/46_firmware
- bently_nevada_3701\/40
- bently_nevada_3701\/40_firmware
- bently_nevada_3701\/46
- bently_nevada_60m100_firmware
- bently_nevada_3701\/44_firmware
- bently_nevada_60m100
- bently_nevada_3701\/44
CWE
CWE-798
Use of Hard-coded Credentials