---
id: CVE-2022-29966
title: Emerson Ovation Missing Authentication for Critical Functionality
summary: "Emerson Ovation\_has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition."
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: Emerson
product: Ovation
affected:
  - Ovation <= Version 3.8.0 Feature Pack 1
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:00:59.629Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-29966'
references:
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02'
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json
tags:
  - cve.org
epss: 0.00393
epssPercentile: 0.33687
ingestedAt: '2026-11-05T20:33:06.616Z'
---

## Overview

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.

## Affected

- `Ovation <= Version 3.8.0 Feature Pack 1`

## Remediation

Emerson recommends the following:


  *  Upgrade to the currently available release of Ovation 3.8.0 Feature Pack 3 for remediation of many of the identified vulnerabilities.
  *  Users are advised to consider the use of OCR3000 controllers, which offer an extra layer of protection that is not available to older controller models.
  *  Deploy and configure Ovation systems and related components as described in the Cybersecurity for Ovation Systems manual (OVREF1000).  Ovation Users' Group Website (User Manuals | Reference Manuals) https://www.ovationusers.com/  (login required)
  *  Users with questions or concerns regarding the impact of these vulnerabilities on Ovation should contact the
Ovation-CERT by email or phone (1-800-445-9723, option 3).