Security readout for executives and security teams
Plain-English summary
This flaw affects JTEKT TOYOPUC PLCs that expose the CMPLink/TCP engineering protocol. The protocol lacks authentication, so reachable attackers may perform sensitive PLC engineering actions. For operations leaders, the concern is unauthorized control or disruption of industrial equipment, not data theft.
Executive priority
Treat this as an urgent operational technology exposure review. Prioritize sites where TOYOPUC PLCs are reachable beyond tightly controlled engineering networks, because impact can include process disruption or unauthorized control changes.
Technical view
CVE-2022-29951 is CWE-306 missing authentication in TOYOPUC PLC CMPLink/TCP through 2022-04-29. The protocol can run over TCP or UDP on configurable ports 1024-65534 and supports engineering functions including PLC start/stop, project upload/download, and configuration changes. CVSS is 9.1 with network, no-auth attack conditions.
Likely exposure
Exposure is most likely in industrial sites using JTEKT TOYOPUC PLCs where CMPLink/TCP is reachable from untrusted networks, flat plant networks, remote access paths, or vendor engineering workstations.
Exploitation context
The provided bundle does not show CISA KEV listing or active exploitation evidence. The risk is still severe because unauthenticated network reachability can allow integrity and availability impact against PLC operations.
Researcher notes
Public source data names the protocol behavior and impact class, but the supplied affected-product metadata is incomplete. Avoid assuming specific TOYOPUC models, firmware builds, patches, or exploitation until confirmed from vendor or CISA advisory details.
Mitigation direction
- Check JTEKT and CISA guidance for supported updates, configuration changes, or compensating controls.
- Restrict CMPLink/TCP access to authorized engineering hosts only.
- Segment PLC networks from enterprise, internet, and remote-access networks.
- Block unnecessary TCP and UDP ports in the 1024-65534 range to PLCs.
- Monitor for unexpected engineering-protocol activity and unauthorized configuration changes.
Validation and detection
- Inventory TOYOPUC PLCs and identify firmware or software status against vendor guidance.
- Identify where CMPLink/TCP is enabled and which TCP or UDP ports are reachable.
- Review firewall and segmentation rules protecting PLC engineering interfaces.
- Confirm only approved engineering workstations can communicate with affected PLC ports.
- Review PLC change history and engineering access records for suspicious activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-29951 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.forescout.com/blog/CVE reference · x_refsource_MISC
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.