How severe is CVE-2022-30314?

CVE-2022-30314 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2022-30314 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-30314?

CVE-2022-30314 affects Honeywell Safety Manager Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-30314?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-30314 published?

CVE-2022-30314 was published on 2022-07-28 and last updated on 2026-06-17.

CVE-2022-30314

CVE-2022-30314 is a medium-severity vulnerability in Honeywell Safety Manager Firmware with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-798.

Key facts

Severity: Medium (CVSS 3.x base score 4.6)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-798
Affected product: Honeywell Safety Manager Firmware
Published: 2022-07-28
Last modified: 2026-06-17

Description

Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. The affected components are characterized as: POLO bootloader. The potential impact is: Manipulate firmware. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 serial interface for firmware management purposes. When booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is controlled by means of credentials hardcoded in the Safety Manager firmware. The credentials for the bootloader are hardcoded in the firmware. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize these credentials to control the boot process and manipulate the unauthenticated firmware image (see FSCT-2022-0054).

Frequently asked questions

What is CVE-2022-30314?: Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. The affected components are characterized as: POLO bootloader. The potential impact is: Manipulate firmware. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 serial interface for firmware management purposes. When booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is controlled by means of credentials hardcoded in the Safety Manager firmware. The credentials for the bootloader are hardcoded in the firmware. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize these credentials to control the boot process and manipulate the unauthenticated firmware image (see FSCT-2022-0054).
How severe is CVE-2022-30314?: CVE-2022-30314 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2022-30314 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-30314?: CVE-2022-30314 affects Honeywell Safety Manager Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-30314?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-30314 published?: CVE-2022-30314 was published on 2022-07-28 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:honeywell:safety_manager_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Honeywell Safety Manager Firmware

CVE-2022-30315 — Critical (CVSS 9.8): Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data…
CVE-2022-30313 — High (CVSS 7.5): Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According…
CVE-2022-30316 — Medium (CVSS 6.8): Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to…

All CVEs affecting Honeywell Safety Manager Firmware →

Other CWE-798 (Use of Hard-coded Credentials) vulnerabilities

CVE-2026-13768 — Critical (CVSS 10.0): Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub…
CVE-2026-45631 — Critical (CVSS 10.0): Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded…
CVE-2026-22769 — Critical (CVSS 10.0): Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.…
CVE-2025-42890 — Critical (CVSS 10.0): SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended…
CVE-2025-7503 — Critical (CVSS 10.0): An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with…
CVE-2025-20309 — Critical (CVSS 10.0): A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session…

Browse all CWE-798 (Use of Hard-coded Credentials) vulnerabilities →