CVE-2022-30260

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-26 · updated 2026-06-17
Weakness: CWE-345

Description

Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV M-series, DeltaV S-series, DeltaV P-series, DeltaV SIS, and DeltaV CIOC/EIOC/WIOC IO cards.

Affected products

Emerson Deltav Distributed Control System Sq Controller Firmware: before 14.3 — fixed in 14.3
Emerson Deltav Distributed Control System Sx Controller Firmware: before 14.3 — fixed in 14.3
Emerson Se4002S1T2B6 High Side 40-Pin Mass I/O Terminal Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4003S2B4 16-Pin Mass I/O Terminal Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4003S2B524-Pin Mass I/O Terminal Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4017P0 H1 I/O Interface Card And Terminl Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4017P1 H1 I/O Card With Integrated Power Firmware: before 14.3 — fixed in 14.3
Emerson Se4019P0 Simplex H1 4-Port Plus Fieldbus I/O Interface With Terminalblock Firmware: before 14.3 — fixed in 14.3
Emerson Se4026 Virtual I/O Module 2 Firmware: before 14.3 — fixed in 14.3
Emerson Se4027 Virtual I/O Module 2 Firmware: before 14.3 — fixed in 14.3
Emerson Se4032S1T2B8 High Side 40-Pin Do Mass I/O Terminal Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4037P0 H1 I/O Interface Card And Terminl Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4037P1 Redundant H1 I/O Card With Integrated Power And Terminal Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4039P0 Redundant H1 4-Port Plus Fieldbus I/O Interface With Terminalblock Firmware: before 14.3 — fixed in 14.3
Emerson Se4052S1T2B6 High Side 40-Pin Mass I/O Terminal Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4082S1T2B8 High Side 40-Pin Do Mass I/O Terminal Block Firmware: before 14.3 — fixed in 14.3
Emerson Se4100 Simplex Ethernet I/O Card (Eioc) Assembly Firmware: before 14.3 — fixed in 14.3
Emerson Se4101 Simplex Ethernet I/O Card (Eioc) Assembly Firmware: before 14.3 — fixed in 14.3
Emerson Se4801T0X Redundant Wireless I/O Card Firmware: before 14.3 — fixed in 14.3
Emerson Ve4103 Modbus Tcp Interface For Ethernet Connected I/O (Eioc) Firmware: before 14.3 — fixed in 14.3
Emerson Ve4104 Ethernet/Ip Control Tag Integration For Ethernet Connected I/O (Eioc) Firmware: before 14.3 — fixed in 14.3
Emerson Ve4105 Ethernet/Ip Interface For Ethernet Connected I/O (Eioc) Firmware: before 14.3 — fixed in 14.3
Emerson Ve4106 Opc-Ua Client For Ethernet Connected I/O (Eioc) Firmware: before 14.3 — fixed in 14.3
Emerson Ve4107 Iec 61850 Mms Interface For Ethernet Connected I/O (Eioc) Firmware: before 14.3 — fixed in 14.3

How to fix

Upgrade to a fixed version: Emerson Deltav Distributed Control System Sq Controller Firmware 14.3; Emerson Deltav Distributed Control System Sx Controller Firmware 14.3; Emerson Se4002S1T2B6 High Side 40-Pin Mass I/O Terminal Block Firmware 14.3; Emerson Se4003S2B4 16-Pin Mass I/O Terminal Block Firmware 14.3; Emerson Se4003S2B524-Pin Mass I/O Terminal Block Firmware 14.3; Emerson Se4017P0 H1 I/O Interface Card And Terminl Block Firmware 14.3; Emerson Se4017P1 H1 I/O Card With Integrated Power Firmware 14.3; Emerson Se4019P0 Simplex H1 4-Port Plus Fieldbus I/O Interface With Terminalblock Firmware 14.3; Emerson Se4026 Virtual I/O Module 2 Firmware 14.3; Emerson Se4027 Virtual I/O Module 2 Firmware 14.3; Emerson Se4032S1T2B8 High Side 40-Pin Do Mass I/O Terminal Block Firmware 14.3; Emerson Se4037P0 H1 I/O Interface Card And Terminl Block Firmware 14.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-30260 or the next vulnerability affects your stack