Overview of CVE-2022-29966: Missing Authentication in Emerson Ovation Controller Protocols

Introduction

Several engineering protocols in Emerson's Ovation distributed control system accept commands without checking who sent them, so anyone who can reach a controller on the network could change its configuration or push it into a denial-of-service condition. Ovation runs inside power generation and water operations, and the flaw behind CVE-2022-29966 sits in its trust model, which treats network position as identity, rather than in a single coding error.

Ovation is Emerson's distributed control system (DCS) for power generation and water or wastewater operations. CISA describes the affected equipment as deployed worldwide in the Energy sector, and Emerson positions Ovation as an industry-leading automation platform for power and water customers (most recently in its Ovation 4.0 announcement of July 23, 2024, which is vendor positioning rather than an independent market-share figure). That footprint puts the platform in infrastructure where controller integrity and availability are core operational requirements.

CISA published its Emerson Ovation advisory on June 6, 2024, rating this issue CVSS v3.1 9.8. The NVD page for this CVE returned "CVE ID Not Found" when our source briefing was compiled, so we rely on the CISA advisory, its CSAF file, and the CVE record for the details below.

Technical information

Root cause: missing authentication on critical functions

CISA classifies CVE-2022-29966 as CWE 306, Missing Authentication for Critical Function. The advisory states that several Ovation protocols have no authentication, which could allow an attacker to change controller configuration or cause a denial of service.

This is an insecure-by-design weakness rather than an implementation bug. There is no memory corruption, no malformed input, and no published password-guessing technique. An attacker sends ordinary engineering protocol commands, and the controller acts on them.

A malicious configuration write can therefore look exactly like a legitimate one issued from an engineering workstation. The public advisory does not identify the protocol names, port numbers, message formats, or the exact controller commands involved, and Emerson has not published how the fix changes them.

Scoring

CISA publishes the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8) and a separate CVSS v4.0 score of 9.3. The two numbers come from different scoring versions and do not conflict.

No privileges and no user interaction are required, and that drives the score. The score describes the preconditions for exploitation. It says nothing about observed attacks.

Attack flow

Based on what CISA discloses, exploitation reduces to a short sequence:

1. Reach the controller protocols. The attacker needs a network path to the affected Ovation protocol interfaces. CISA's accompanying guidance (no internet exposure, firewalls, isolation from business networks, controlled remote access) describes the paths defenders are expected to close.
2. Send unauthenticated commands. No credentials, session, or user interaction are required, matching PR:N and UI:N.
3. Controller processes the request. Because the protocols carry no authentication, the controller cannot distinguish the attacker's traffic from that of a legitimate engineering workstation or HMI.
4. Impact. The documented outcomes are changes to controller configuration or a denial-of-service condition.

We deliberately do not describe packet sequences or ports, because none are published.

Keep CVE-2022-30267 separate

The same CISA advisory covers CVE-2022-30267, which involves missing authentication of firmware signing and reliance on an insecure checksum. That separate weakness could allow malicious firmware images, denial of service, or remote code execution. The advisory's remote code execution language belongs to CVE-2022-30267 and should not be read as a demonstrated capability of CVE-2022-29966.

Exploitation status

CISA stated that no known public exploitation specifically targeting these vulnerabilities had been reported to it as of the June 6, 2024 advisory. Tenable's dedicated plugin states that no known exploits are available. No threat actor attribution exists in the reviewed material. CISA credits Daniel dos Santos and Jos Wetzels of Forescout Technologies with the report. Forescout's OT:ICEFALL research (published June 20, 2022) described 56 vulnerabilities across 10 OT vendors and listed Emerson Ovation among the affected product families. That research gives context. It is not evidence of an attack campaign.

Patch information

The fix ships as a vendor release. Ovation is closed source, so there is no public code patch, commit, or diff. CISA lists Ovation 3.8.0 Feature Pack 1 and earlier as affected, and Emerson's remediation is to upgrade to Ovation 3.8.0 Feature Pack 3.

Where the fix is recorded

• CVE record (CNA: icscert): The affected block marks versions up to and including Version 3.8.0 Feature Pack 1 as affected and explicitly lists 3.8.0 Feature Pack 3 as unaffected. This is the clearest per-CVE confirmation that FP3 addresses this flaw.
• CISA CSAF advisory: For CVE-2022-29966, the upgrade is tagged as a vendor_fix remediation applying to the affected product ID:

{
  "category": "vendor_fix",
  "details": "Upgrade to the currently available release of Ovation 3.8.0 Feature Pack 3 for remediation of many of the identified vulnerabilities.",
  "product_ids": ["CSAFPID-0001"]
}

What the fix has to address. Closing a CWE 306 weakness requires the controller to verify who is sending a command before acting on it. Emerson has not published how FP3 does this, which protocols were changed, or what mechanism (for example, session authentication or credentials) was added. Treat FP3 as a vendor-validated release that you cannot review line by line.

Caveats when reading the fix data

1. Broad wording. "Many of the identified vulnerabilities" spans both CVEs in the advisory. The CVE record's unaffected status for FP3 is what ties the fix to CVE-2022-29966 specifically.
2. Feature Pack 2 is not covered. The affected range stops at FP1 and the confirmed fixed version is FP3. No public source addresses FP2, so plan to move to FP3.
3. The upgrade is paired with other measures. Emerson also recommends considering OCR3000 controllers, which it says add a layer of protection older controller models lack. It also recommends deploying per the Cybersecurity for Ovation Systems manual (OVREF1000), which the CSAF file also tags as a vendor_fix and which is available from the Ovation Users' Group site (login required). This suggests the full remediation depends on secure configuration and controller hardware as well as software.

Getting the update. FP3 is not publicly downloadable. Operators obtain it through Emerson support channels. For questions about a specific deployment, Emerson points customers to Ovation CERT ([email protected], 1 800 445 9723 option 3).

Alongside the upgrade, CISA recommends keeping control system devices off the internet, placing control networks behind firewalls isolated from business networks, using updated VPNs where remote access is required (noting VPNs are only as secure as the connected devices), and performing impact analysis and risk assessment before deploying defensive changes.

Detection methods

No public Sigma, YARA, or Snort/Suricata rule and no CVE-specific IoC list has been published. Detection falls into two categories: commercial vulnerability scanning to find affected controllers, and OT-aware network monitoring to observe use of the affected protocols.

Why signatures are hard. Nothing malformed is sent. Detection therefore depends on who is talking to the controller and what kind of operation they send. With no reported in-the-wild exploitation, there are no IoCs to hunt.

1. Finding affected assets: Tenable OT Security plugin 502373

• Name: Emerson Ovation Missing Authentication for Critical Function (CVE-2022-29966), file tenable_ot_emerson_CVE-2022-29966.nasl.
• Type: remote check, Tenable.ot family, critical severity.
• Platform: works only with Tenable.ot, and the only supported sensor is Tenable OT Security.
• Prerequisite: the Tenable.ot/Emerson KB item, meaning the Ovation asset must already be discovered and fingerprinted.
• Hardware covered (CPE): Ovation OCC100, OCR1100, OCR3000, and OCR400 controllers.
• Limits: a positive result shows that a vulnerable controller is present. It does not show that the controller has been attacked. The detection logic is proprietary.

Without Tenable.ot, a rougher equivalent is to inventory Ovation controllers and compare release levels against the affected range (3.8.0 FP1 and earlier).

2. Detecting misuse: deep packet inspection of Ovation protocols

Forescout states that this class of flaw calls for OT-aware network monitoring and deep packet inspection, and that eyeInspect can natively monitor the protocols used by the affected devices. Its OT:ICEFALL page claims built-in detection for exploitation of OT:ICEFALL vulnerabilities through a monthly-updated threat library with ICS-specific IoCs and CVEs. This tooling is commercial and closed. Forescout has not published protocol names, ports, or signature logic.

3. Hunting without a signature

The sources support these approaches, though no specific rules are published for them:

• Map who may talk to controllers. Since the protocols do not authenticate, network position is the only separator between an engineer and an attacker. Record which engineering workstations and HMIs normally send configuration traffic to OCC100, OCR400, OCR1100, and OCR3000 controllers, and alert on new source hosts, especially outside the control network segment.
• Watch state-changing operations. Focus on configuration change and control operations aimed at controllers and check them against change windows. Only DPI that parses Ovation protocols can reliably tell a read from a write.
• Correlate with availability problems. An unexplained controller fault or communication loss right after traffic from an unusual host warrants investigation.
• Monitor firmware loads. Given CVE-2022-30267 in the same advisory, firmware load activity on these controllers is a related high-value event.

CISA's advisory also points to its Targeted Cyber Intrusion Detection and Mitigation Strategies guidance and asks organizations observing suspected malicious activity to report it to CISA.

Affected systems and versions

Tenable associates its detection plugin with the OCC100, OCR1100, OCR3000, and OCR400 controller platforms. OCR3000 appears in this list even though Emerson recommends considering OCR3000 for its extra protection layer, so running OCR3000 hardware does not by itself mean an installation is unaffected. The CISA software range remains the principal applicability statement, and no per-model remediation matrix has been published.

Vendor security history

A 2019 CISA advisory covered Ovation OCR400 controllers running version 3.3.1 or earlier:

• CVE-2019-10967: stack-based buffer overflow, CVSS 6.3.
• CVE-2019-10965: heap-based buffer overflow, CVSS 6.8.

Both involved handling long input through the FTP service and could allow privilege escalation, remote code execution, or a controller halt. Emerson's response was to upgrade older software, return enabled FTP services to their default disabled state where practical, and otherwise restrict FTP to required database and controller drops. CISA reported no known public exploits for those issues. This history does not mean the 2019 FTP issues and CVE-2022-29966 share a protocol, and the FTP guidance should not be treated as a remedy for this CVE.

CVE-2022-29966 itself traces back to Forescout's OT:ICEFALL research into insecure-by-design practices across OT vendors. Emerson provides a Power and Water Cybersecurity Suite, cybersecurity services, and a Trust Center with vulnerability reporting channels. These are useful controls, but host security tooling does not remove the protocol authentication weakness.

References

• NVD entry for CVE-2022-29966
• CVE record for CVE-2022-29966
• CISA ICS Advisory: Emerson Ovation
• CISA CSAF file for the Emerson Ovation advisory (raw)
• CISA CSAF file for the Emerson Ovation advisory (GitHub)
• Tenable OT plugin 502373
• Cybersecurity Help bulletin SB2024060714
• INCIBE CERT: Multiple vulnerabilities in Emerson Ovation
• Forescout: OT:ICEFALL, 56 Vulnerabilities Caused by Insecure by Design Practices in OT
• Forescout Research Labs: OT:ICEFALL
• Insecure by Design in the Backbone of Critical Infrastructure (ACM)
• CISA ICS Advisory: Emerson Ovation OCR400 Controller (2019)
• Emerson Trust Center
• Emerson ICS Cyber Security for Ovation
• Emerson Cybersecurity Services for Power and Water
• Emerson Cybersecurity Guidebook for Power and Water Industries (PDF)
• Emerson Ovation 4.0 announcement
• Ovation Controller, I/O and Software Update