CVEvulnerability

CVE-2022-29952

9.1 CRITICAL Published 2022-07-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-306

Description

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.

Affected configurations

• bakerhughes bently nevada 3701\/40 firmware (< 4.1) • bakerhughes bently nevada 3701\/44 firmware (< 4.1) • bakerhughes bently nevada 3701\/46 firmware (< 4.1) • bakerhughes bently nevada 60m100 firmware

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

Referenced by CWE · observed example (2)

  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References