# CVE-2022-29966

Unauthenticated Ovation protocols allow controller config changes or DoS.

- Page: https://www.vulneraibility.com/cve/CVE-2022-29966
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-306
- Published: 2026-11-03

## Affected versions

- Emerson Ovation: affected <= Version 3.8.0 Feature Pack 1; fixed in 3.8.0 Feature Pack 3

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated actor can change controller configuration or cause denial-of-service, disrupting industrial processes and safety systems.

## Action

Immediate action required

## Recommendation

Isolate Ovation systems, apply vendor mitigations, restrict network access, monitor logs, patch when available

## References

- [other] https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02
- [other] https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.