Most recent entries from all

bdu:2022-03760

EUVD-2026-16442

fkie_cve-2022-30275

The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in the wmdlcdrv.ini driver configuration file. In addition, this password is used for access control to MOSCAD/STS projects protected with the Legacy Password feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against the password in the driver configuration file.

GHSA-wm34-q93c-vxx8

gsd-2022-30275

ICSA-22-179-05 — Motorola Solutions MDLC

The MDLC protocol has a legacy encryption mode that encrypts traffic using the tiny encryption algorithm (TEA) block-cipher in ECB mode, which offers no message integrity and reduced confidentiality. An attacker could craft messages with ciphertext blocks inserted at certain positions resulting in known plaintext at a given offset. This could either lead to message manipulation or exposure of the attack surface of the MDLC protocol parser to memory corruption attacks.CVE-2022-30273 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N). The affected product utilizes an MDLC driver that has a password stored in plaintext in the wmdlcdrv.ini driver configuration file.CVE-2022-30275 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).