Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication.

published 2022-07-26 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-34259

cvss: 9.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.

Patch / fix

fixed in 3

bakerhughes bently_nevada_3701/40_firmware 4.1
bakerhughes bently_nevada_3701/44_firmware 4.1
bakerhughes bently_nevada_3701/46_firmware 4.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-188-02 updated 2022-07-07 cvss 7.4

Bently Nevada ADAPT 3701/4X Series and 60M100

Bently Nevada, Baker Hughes Bently Nevada 60M100 (3701/60) Bently Nevada, Baker Hughes Bently Nevada 3701/40 < 4.1 Bently Nevada, Baker Hughes Bently Nevada 3701/44 < 4.1 Bently Nevada, Baker Hughes Bently Nevada 3701/46 < 4.1
affected: mitigation “Bently Nevada recommend users upgrade 3701/4x series to Version 4.1.1712.0601 or higher, which has the diagnostics port disabled and the hardcoded credentials removed from the firmware image.” bntechsupport.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

forescout.com /blog/
third-party-advisory
cisa.gov /uscert/ics/advisories/icsa-22-188-02
mitigation, third-party-advisory, us-government-resource

Sources

CVE List CVE-2022-29952
NVD CVE-2022-29952

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary