« Volver al listado

CVE-2022-30275

Estado: ModificadaAlta (7.5)—

The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in the wmdlcdrv.ini driver configuration file. In addition, this password is used for access control to MOSCAD/STS projects protected with the Legacy Password feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against the password in the driver configuration file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Motorolasolutions — Mdlc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-30275",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-26T22:15:11.273",
  "references": [
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.forescout.com/blog/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.forescout.com/blog/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in the wmdlcdrv.ini driver configuration file. In addition, this password is used for access control to MOSCAD/STS projects protected with the Legacy Password feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against the password in the driver configuration file."
    },
    {
      "lang": "es",
      "value": "El software MOSCAD Toolbox de Motorola versiones hasta 02-05-2022, es basado en una contraseña en texto sin cifrar. Usa un controlador MDLC para comunicarse con las RTU de MOSCAD/ACE con fines de ingeniería. El acceso a estas comunicaciones está protegido por una contraseña almacenada en texto sin cifrar en el archivo de configuración del driver wmdlcdrv.ini. Además, esta contraseña es usado para el control de acceso a los proyectos de MOSCAD/STS protegidos con la función Legacy Password. En este caso, un CRC no seguro de la contraseña está presente en el archivo del proyecto: este CRC es comprobado contra la contraseña en el archivo de configuración del controlador."
    }
  ],
  "lastModified": "2026-06-17T04:43:23.680",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:motorolasolutions:mdlc:4.80.0024:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83AC1904-7229-4B7E-919B-9617D9AB2A02"
            },
            {
              "criteria": "cpe:2.3:a:motorolasolutions:mdlc:4.82.004:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "824D6C18-5549-4FF0-BAB9-5FD2B457D03C"
            },
            {
              "criteria": "cpe:2.3:a:motorolasolutions:mdlc:4.83.001:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C158107A-2731-47CE-8BA6-A10DD51F1DEE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}