Emerson Ovation, CVE-2022-29966: a new CVE scored 9.8

The bottom line

Any site running Emerson Ovation should act now: the record scores this 9.8 (Critical, CVSS 3.1) and no login is required to attack it. The first step is to confirm whether Ovation is reachable from any untrusted network segment and to contact Emerson for patch status, as no source names a confirmed fixed version.

Free analysis report · 9 pagesEmerson Ovation, CVE-2022-29966: a new CVE scored 9.8The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

Several protocols in Emerson Ovation carry no authentication at all. The record says an attacker who can reach the system over a network could change controller configuration or force a denial-of-service condition without any credentials.

Why it matters

CWE-306 — missing authentication for a critical function — means no credential stands between an attacker and the ability to send commands to the controller. For a control system, changing controller configuration can alter physical processes; a denial-of-service condition can interrupt monitoring or control entirely. Our reading is that authentication gaps across multiple protocols widen the attack surface considerably: every reachable protocol is a separate path in, not a single point to block. The record was published by ICS-CERT, which is specific to operational technology environments.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• Our Ovation network is air-gapped, so we are safe The record does not condition the flaw on internet access. An air gap reduces exposure but must be confirmed as genuine and actively monitored before concluding no action is needed.
• Version 3.8.0 Feature Pack 1 is the confirmed fix The record lists versions before 3.8.0 FP1 as affected and also lists 3.8.0 FP3 as affected. No source names a confirmed fixed version; seek guidance from Emerson directly.
• A CVSS score of 9.8 means this is already being exploited The score reflects potential impact, not observed exploitation. This record is new and was not on CISA's exploited vulnerabilities list when read.

How we would triage it

This is our judgement.

Step 1: Find the Ovation version you run

• Check the Ovation configuration manager or the system about screen for the installed version number and feature pack identifier.
• Confirm whether the version falls in the affected ranges stated in the record: before 3.8.0 Feature Pack 1, or at 3.8.0 Feature Pack 3.

Step 2: Map who can reach the Ovation control network

• Review firewall rules and network diagrams to confirm whether any untrusted host, corporate IT segment, or external vendor connection can initiate traffic to Ovation systems.
• Verify that network segmentation is enforced at the boundary device, not only documented in a diagram.

Step 3: Restrict untrusted access while awaiting a patch

• Block traffic from untrusted segments to Ovation systems at the network boundary until Emerson confirms a fixed version.
• No source names a fixed version; contact Emerson or your system integrator to obtain patch status and a confirmed release timeline.

Step 4: Confirm the fix when a patched version is available

• When Emerson provides a patched release, verify the installed version matches what the vendor states as fixed before reconnecting the system to wider network segments.
• Document the installed version and the date it was verified.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

We are reviewing CVE-2022-29966 affecting Emerson Ovation. The record scores this 9.8 (Critical, CVSS 3.1): several Ovation protocols carry no authentication, letting a network attacker change controller configuration or cause a denial-of-service condition. Affected versions listed in the record are: before 3.8.0 Feature Pack 1, and 3.8.0 Feature Pack 3. No source we have read names a confirmed fixed version. Please confirm whether we run Ovation, which version is installed, whether it is reachable from any untrusted network segment, and what patch or workaround Emerson has issued. We would like written confirmation of the installed version, patch status, and any network isolation measures in place within five working days.

The weakness behind it

The record classes this as CWE-306.

• CWE-306 →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

The CVE record:

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.

Versions of Emerson Ovation the record lists as affected:

• all versions up to, but not including, Version 3.8.0 Feature Pack 1
• 3.8.0 Feature Pack 3

Check your own project

If you build software, you can compare what a project declares with this CVE from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE id leaves your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2022-29966

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Check the servers you run

The same id can be checked against a host. Run this on the machine itself, not on the laptop that deploys to it: it reads installed packages (dpkg, rpm or apk), snaps, the names of running container images and the kernel version, compares them on the spot, and only the CVE ids leave the machine; the inventory stays on it, in ~/.lattice-scan. Naming the CVEs needs no key. Do it on each server after a deployment, and again when a new entry lands.

lattice-scan --cve CVE-2022-29966

A match is a candidate for a person to confirm, not a finding. A distribution can fix a CVE under an unchanged version number, so a match is a candidate; on Debian-family hosts the report also shows whether the package's own changelog names the CVE. It reads the names of the running images, not what is inside them; for what an image declares, use the project check on its Dockerfile.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

• Which way into Lattice fits your job →The command line, the Claude skill or the MCP server: what each needs, what works without a key and how to read the result.
• Lattice, the MCP server →The public graph the command reads, for AI agents over MCP.
• Install and connect →The signed apt repository, the fingerprint, and the connection commands for each client.

What we do not know yet

• No vendor advisory was available; the confirmed fixed version and any official workaround are not stated in the record.
• Which specific Ovation protocols lack authentication is not named in the record.
• Whether the flaw is exploitable over a routed wide-area connection or requires local network access is not stated.
• Whether any compensating control at the protocol or network layer reduces exposure is not addressed in the record.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 3 November 2026. We have not read the vendor's advisory page and we have not tested it.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.