CVE-2022-29959

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Aug 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-29967.4A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. CVE-2022-299605.5Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of CVE-2022-299625.5The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credenti CVE-2022-299635.5The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provi CVE-2022-299645.5The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access t CVE-2022-299655.5The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged opera CVE-2022-299677.5static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.CVE-2022-299687.8An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.CVE-2022-299696.1The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag CVE-2022-29978.0Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.CVE-2022-299707.5Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.CVE-2022-299717.8An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 thr