LiveActive security incident?Get immediate response
CVE Record

CVE-2022-30319: Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass.

Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a Saia Burgess Controls (SBC) PCD S-Bus authentication bypass issue. The affected components are characterized as: S-Bus (5050/UDP) authentication. The potential impact is: Authentication bypass. The Saia Burgess Controls (SBC) PCD controllers utilize the S-Bus protocol (5050/UDP) for a variety of engineering purposes. It is possible to configure a password in order to restrict access to sensitive engineering functionality. Authentication functions on the basis of a MAC/IP whitelist with inactivity timeout to which an authenticated client's MAC/IP is stored. UDP traffic can be spoofed to bypass the whitelist-based access control. Since UDP is stateless, an attacker capable of passively observing traffic can spoof arbitrary messages using the MAC/IP of an authenticated client. This allows the attacker access to sensitive engineering functionality such as uploading/downloading control logic and manipulating controller configuration.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This issue can let an attacker bypass S-Bus authentication on Saia Burgess Controls PCD controllers if they can observe trusted traffic. The business risk is unauthorized access to engineering functions, including control logic transfer and controller configuration changes. No active exploitation is stated in the supplied sources.

Executive priority

Treat this as a high-priority OT exposure review if SBC PCD controllers are present. The issue affects authentication around engineering functions, so unauthorized access could affect controller logic or configuration. Prioritize segmentation and vendor-guidance review before routine IT issues.

Technical view

CVE-2022-30319 affects SBC PCD controllers through 2022-05-06 using S-Bus on 5050/UDP. Authentication relies on a MAC/IP whitelist with inactivity timeout. Because UDP is stateless, a passive observer can spoof an authenticated client’s MAC/IP and access sensitive engineering functionality.

Likely exposure

Exposure is most likely where SBC PCD controllers have S-Bus 5050/UDP reachable from engineering networks, shared industrial networks, or any segment where traffic can be passively observed. Public internet exposure is not stated in the sources.

Exploitation context

The supplied sources describe a passive-observation prerequisite and UDP spoofing against whitelist-based access control. CISA KEV status is false in the bundle, and no cited source here confirms active exploitation.

Researcher notes

The bundle does not include CVSS, CWE, or detailed affected version metadata beyond SBC PCD through 2022-05-06. Analysis should stay anchored to S-Bus 5050/UDP, whitelist-based authentication, passive observation, and spoofing risk. Do not assume broader Honeywell/SBC product impact without vendor evidence.

Mitigation direction

  • Review CISA and vendor guidance for supported fixes or compensating controls.
  • Identify SBC PCD controllers using S-Bus on 5050/UDP.
  • Avoid exposing S-Bus to untrusted or broadly shared networks.
  • Restrict engineering access paths to trusted, monitored administrative segments.
  • Monitor for unexpected engineering actions or configuration changes.

Validation and detection

  • Inventory SBC PCD controllers and firmware or configuration dates.
  • Confirm whether S-Bus 5050/UDP is enabled and reachable.
  • Map which engineering hosts are permitted to communicate with controllers.
  • Review logs or telemetry for unusual S-Bus engineering activity.
  • Check whether compensating controls match current CISA or vendor guidance.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-30319 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.