Most recent entries from all

bdu:2022-03756

2026-10-14T13:10:59.506237+00:00

bdu:2022-03756

EUVD-2026-16451

2026-10-14T13:10:59.506285+00:00

EUVD-2026-16451

fkie_cve-2022-30269

2026-10-14T13:10:59.506302+00:00

Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.

GHSA-p4gj-rmqv-7h27

2026-10-14T13:10:59.506375+00:00

gsd-2022-30269

2026-10-14T13:10:59.506393+00:00

gsd-2022-30269

ICSA-22-179-06 — Motorola Solutions ACE1000

2026-10-14T13:10:59.506404+00:00

The affected product ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no such file yet exists. As such, this hard-coded key is likely to be used by default. This could allow an attacker to remotely execute code, manipulate configuration, or cause a denial-of-service condition.CVE-2022-30271 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The affected product SSH service is controlled by five preconfigured accounts, all of which come with default hard-coded credentials. This could allow an attacker to manipulate configuration, remotely execute code, and cause a denial-of-service condition.CVE-2022-30270 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The affected device communicates with an XRT Lan-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the tiny encryption algorithm (TEA) in ECB mode using a hardcoded key, which could allow an attacker to manipulate the device configuration.CVE-2022-30274 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The affected product allows for custom application installation…