Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
bakerhughes bently_nevada_3701\\/40_firmware |
||
bakerhughes bently_nevada_3701\\/44_firmware |
||
bakerhughes bently_nevada_3701\\/46_firmware |
||
bakerhughes bently_nevada_60m100_firmware - |
Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources Nearly 60 holes found affecting 'more than 30,000' machines worldwide
Fifty-six vulnerabilities – some deemed critical – have been found in industrial operational technology (OT) systems from ten global manufacturers including Honeywell, Ericsson, Motorola, and Siemens, putting more than 30,000 devices worldwide at risk, according to the US government's CISA and private security researchers. Some of these vulnerabilities received CVSS severity scores as high as 9.8 out of 10. That is particularly bad, considering these devices are used in critical infras...
Vulmon