CVE-2022-30315
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedHoneywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion PKS Safety Manager insufficient logic security controls issue. The affected components are characterized as: Honeywell FSC runtime (FSC-CPU, QPP), Honeywell Safety Builder. The potential impact is: Remote Code Execution, Denial of Service. The Honeywell Experion PKS Safety Manager family of safety controllers utilize the unauthenticated Safety Builder protocol (FSCT-2022-0051) for engineering purposes, including downloading projects and control logic to the controller. Control logic is downloaded to the controller on a block-by-block basis. The logic that is downloaded consists of FLD code compiled to native machine code for the CPU module (which applies to both the Safety Manager and FSC families). Since this logic does not seem to be cryptographically authenticated, it allows an attacker capable of triggering a logic download to execute arbitrary machine code on the controller's CPU module in the context of the runtime. While the researchers could not verify this in detail, the researchers believe that the microprocessor underpinning the FSC and Safety Manager CPU modules is incapable of offering memory protection or privilege separation capabilities which would give an attacker full control of the CPU module. There is no authentication on control logic downloaded to the controller. Memory protection and privilege separation capabilities for the runtime are possibly lacking. The researchers confirmed the issues in question on Safety Manager R145.1 and R152.2 but suspect the issue affects all FSC and SM controllers and associated Safety Builder versions regardless of software or firmware revision. An attacker who can communicate with a Safety Manager controller via the Safety Builder protocol can execute arbitrary code without restrictions on the CPU module, allowing for covert manipulation of control operations and implanting capabilities similar to the TRITON malware (MITRE ATT&CK software ID S1009). A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceHoneywell Experion PKS Safety Manager and FSC controllers accept control logic via an unauthenticated Safety Builder protocol. Attackers who can communicate with the controller can download arbitrary machine code (FLD compiled code) directly to the CPU module without cryptographic verification. The underlying CPU lacks memory protection and privilege separation, enabling full RCE in the runtime context with capabilities similar to TRITON malware.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE dataall versionsCVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Honeywell Safety Manager devices on the networkReview network diagrams and asset inventories for Honeywell Experion PKS Safety Manager or FSC controllers. Use network scanning to detect devices responding to typical industrial protocols on ports used by Safety Builder (consult vendor documentation for specific port numbers).Affected if Honeywell Safety Manager or FSC controllers are present on the network and respond to Safety Builder protocol requests.
-
Verify Safety Builder protocol accessibilityFrom a network perspective, determine if the Safety Builder protocol ports are reachable from network segments that contain non-authorized or untrusted systems. Use port scanning or traffic analysis to identify open ports associated with Safety Builder communication.Affected if The Safety Builder protocol ports are accessible from network segments outside the trusted engineering workstation zone.
-
Assess network segmentation around Safety ManagerReview firewall rules, VLAN configurations, and air-gapping controls between the Safety Manager controllers and the plant floor or corporate networks. Confirm that ACLs permit communication only between the Safety Manager and authorized engineering stations.Affected if Safety Manager controllers are not isolated behind restrictive network boundaries or are reachable from non-engineering workstations.
-
Check for unauthenticated protocol exposureAttempt to initiate a Safety Builder session from a non-authorized host on the same network segment (or review IDS/IPS logs for such attempts). Verify whether the controller accepts logic download commands without requiring authentication credentials.Affected if The Safety Manager accepts connection attempts or responds to protocol commands without authentication from unauthorized hosts.
-
Confirm physical key switch controlsInspect the physical key switch position on the Safety Manager controller (if accessible and safe to do so). Determine whether the key is in the RUN or LOCKED position versus PROGRAM or REMOTE position that could enable logic downloads.Affected if The controller key switch is in a position that permits logic downloads (PROGRAM or REMOTE) rather than secured (LOCKED) position.
If Honeywell Safety Manager devices exist on the network with the Safety Builder protocol accessible from untrusted segments or without proper authentication enforcement, the environment is affected by this vulnerability.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataImplement cryptographic authentication for all logic downloads via the Safety Builder protocol; apply vendor-supplied firmware updates if available; enforce physical keyswitch controls; network segment Safety Manager controllers to limit exposure to untrusted networks.
- Consultation16.0 h
- Implementation40.0 h
- Testing24.0 h
- Review / QA16.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $27,008.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2022-30315 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2022-30315 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data