CVE-2022-29952: Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monit...

Summary

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protoco...

What to do

Update bakerhughes bently_nevada_3701\/40_firmware to version 4.1 or later.
Update bakerhughes bently_nevada_3701\/44_firmware to version 4.1 or later.
Update bakerhughes bently_nevada_3701\/46_firmware to version 4.1 or later.

Affected software

Vendor	Product	Affected versions
bakerhughes	bently_nevada_3701\/40_firmware	< 4.1 `cpe:2.3:o:bakerhughes:bently_nevada_3701\/40_firmware::::::::`
bakerhughes	bently_nevada_3701\/44_firmware	< 4.1 `cpe:2.3:o:bakerhughes:bently_nevada_3701\/44_firmware::::::::`
bakerhughes	bently_nevada_3701\/46_firmware	< 4.1 `cpe:2.3:o:bakerhughes:bently_nevada_3701\/46_firmware::::::::`
bakerhughes	bently_nevada_60m100_firmware	All versions `cpe:2.3:o:bakerhughes:bently_nevada_60m100_firmware:-:::::::*`

Original advisory text

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monit...

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02 Mitigation Third Party Advisory US Government Resource
https://www.forescout.com/blog/ Third Party Advisory