Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Emerson Ovation ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, beliebigen Programmcode auszuführen, oder einen Denial of Service Angriff durchzuführen.
Product
Emerson Ovation ist ein verteiltes Leitsystem (DCS) für Kraftwerke.
Vulnerabilities 2
-
Critical 9.8
Emerson Ovation Missing Authentication for Critical Functionality
Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.
-
High 7.5
Emerson Ovation Insufficient Verification of Data Authenticity
Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.
Revision history
-
#1
Initiale Fassung
References
-
CISA Advisory vom 2026-11-03
https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02
-
GitHub Advisory Database vom 2026-11-03
https://github.com/advisories/GHSA-45HW-93VC-42CP
-
GitHub Advisory Database vom 2026-11-03
https://github.com/advisories/GHSA-QG2P-82G5-QR39