Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2022-30242: Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and t...
CVE-2022-30242 · published 4 years ago
Summary
Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller config...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| honeywell | alerton_ascent_control_module_firmware |
<= 2022-05-04 cpe:2.3:o:honeywell:alerton_ascent_control_module_firmware:*:*:*:*:*:*:*:* |
Original advisory text
Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and t...
Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the knowledge of other users, altering the controller's function capabilities. The changed configuration is not updated in the User Interface, which creates an inconsistency between the configuration display and the actual configuration on the controller. After the configuration change, remediation requires reverting to the correct configuration, requiring either physical or remote access depending on the configuration that was altered.
References
- https://blog.scadafence.com Not Applicable
- https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities Third Party Advisory
- https://www.honeywell.com/us/en/product-security Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published15 Jul 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-30242 · NVD
Track software like this
Free during beta