Is CVE-2022-29957 actively exploited?

No active exploitation of CVE-2022-29957 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-29957 be exploited remotely?

No. CVE-2022-29957 requires local access to exploit.

What is the CVSS score of CVE-2022-29957?

CVE-2022-29957 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2022-29957

HIGH

CVE-2022-29957

CWE-306Published: July 26, 2022· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade (18508/TCP, 18518/TCP); Plug-and-Play (18510/UDP); Hawk services (18507/UDP); Management (18519/TCP); Cold restart (18512/UDP); SIS communications (12345/TCP); and Wireless Gateway Protocol (18515/UDP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.

NVD Source

Technical Analysis

CVE-2022-29957 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.