CVE-2022-30273

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers.
References
Link Resource
https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05 Mitigation Third Party Advisory US Government Resource
https://www.forescout.com/blog/ Not Applicable Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:motorolasolutions:mdlc:4.80.0024:*:*:*:*:*:*:*
cpe:2.3:a:motorolasolutions:mdlc:4.82.004:*:*:*:*:*:*:*
cpe:2.3:a:motorolasolutions:mdlc:4.83.001:*:*:*:*:*:*:*

History

14 Feb 2024, 16:10

Type Values Removed Values Added
References () https://www.forescout.com/blog/ - Third Party Advisory () https://www.forescout.com/blog/ - Not Applicable, Third Party Advisory

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-345

02 Aug 2022, 20:49

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
References (MISC) https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation - (MISC) https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation - Third Party Advisory
References (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05 - (MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05 - Mitigation, Third Party Advisory, US Government Resource
References (MISC) https://www.forescout.com/blog/ - (MISC) https://www.forescout.com/blog/ - Third Party Advisory
CWE CWE-327
CPE cpe:2.3:a:motorolasolutions:mdlc:4.82.004:*:*:*:*:*:*:*
cpe:2.3:a:motorolasolutions:mdlc:4.80.0024:*:*:*:*:*:*:*
cpe:2.3:a:motorolasolutions:mdlc:4.83.001:*:*:*:*:*:*:*

26 Jul 2022, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-07-26 22:15

Updated : 2024-02-14 16:10


NVD link : CVE-2022-30273

Mitre link : CVE-2022-30273

CVE.ORG link : CVE-2022-30273


JSON object : View

Products Affected

motorolasolutions

  • mdlc
CWE
CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-345

Insufficient Verification of Data Authenticity