CVE-2022-30274

The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm (TEA) in ECB mode using a hardcoded key. Similarly, the ACE1000 RTU can route MDLC traffic over Extended Command and Management Protocol (XCMP) and Network Layer (XNL) networks via the MDLC driver. Authentication to the XNL port is protected by TEA in ECB mode using a hardcoded key.
References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06 Mitigation Third Party Advisory US Government Resource
https://www.forescout.com/blog/ Not Applicable
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:motorola:ace1000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:motorola:ace1000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-07-26 23:15

Updated : 2024-02-28 19:29


NVD link : CVE-2022-30274

Mitre link : CVE-2022-30274

CVE.ORG link : CVE-2022-30274


JSON object : View

Products Affected

motorola

  • ace1000
  • ace1000_firmware
CWE
CWE-798

Use of Hard-coded Credentials