Emerson Ovation Missing Authentication for Critical Functionality

Summary

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.

Remediation

1. Inventory every Emerson Ovation deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json
• Referencehttps://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02