Honeywell ControlEdge through R151.1 uses Hard-coded Credentials.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. The affected components are characterized as: SSH. The potential impact is: Remote code execution, manipulate configuration, denial of service. The Honeywell ControlEdge PLC and RTU product line exposes an SSH service on port 22/TCP. Login as root to this service is permitted and credentials for the root user are hardcoded without automatically changing them upon first commissioning. The credentials for the SSH service are hardcoded in the firmware. The credentials grant an attacker access to a root shell on the PLC/RTU, allowing for remote code execution, configuration manipulation and denial of service.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:honeywell:controledge_plc_firmware:*:*:*:*:*:*:*:* | before r151.2 | Vulnerable | Honeywell |
| cpe:2.3:h:honeywell:controledge_plc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Honeywell |
| cpe:2.3:o:honeywell:controledge_rtu_firmware:*:*:*:*:*:*:*:* | before r151.2 | Vulnerable | Honeywell |
| cpe:2.3:h:honeywell:controledge_rtu:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Honeywell |
- cpe:2.3:o:honeywell:controledge_plc_firmware:*:*:*:*:*:*:*:* Versions before r151.2 Vulnerable ·Honeywell
- cpe:2.3:h:honeywell:controledge_plc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
- cpe:2.3:o:honeywell:controledge_rtu_firmware:*:*:*:*:*:*:*:* Versions before r151.2 Vulnerable ·Honeywell
- cpe:2.3:h:honeywell:controledge_rtu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-30318
- 2026-10-03 Alias added: GHSA-2jhj-7g8h-j3h6
References
More Honeywell Controledge Plc Firmware vulnerabilities
- TI-2020-08540 Cleartext transmission of sensitive information in ControlEdge PLC CVSS 3.1HIGH 7.5
- TI-2020-08536 Cleartext transmission of sensitive information in ControlEdge PLC CVSS 3.1HIGH 7.5
Sources
- CVE-2022-30318 · CVE Program
- CVE-2022-30318 · NVD
- FIRST EPSS
- GHSA-2jhj-7g8h-j3h6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences