CVE-2022-2790 MEDIUM

CVE-2022-2790

Vendor Emerson Electric
Product Proficy Machine Edition
Weakness CWE-347
Published August 19, 2022
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic (PDT files) and data blocks data (BLD/BLK files).

Key dates

02Disclosure timeline

August 19, 2022 CVE published
April 16, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-64787 Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347) CVE-2025-34503 Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution CVE-2026-44309 gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVE-2025-24015 Deno's AES GCM authentication tags are not verified