Critical severity · published Jul 26, 2022
CVE-2022-30273
The Motorola MDLC protocol through 2022-05-02 mishandles message integrity
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Mdlc · Motorolasolutions
4.80.0024; 4.82.004; 4.83.001 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-30273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-30273
Third Party Advisory
https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05
Not Applicable
https://www.forescout.com/blog/
More from Mdlc
7.5
CVE-2022-30275
The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password