Emerson Ovation Insufficient Verification of Data Authenticity

Summary

Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.

Remediation

1. Inventory every Emerson Ovation deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json
• Referencehttps://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02