Skip to content
Fencer Vulns
critical 9.8

CVE-2022-30273 json

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity.

published 2022-07-26 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-52228

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-179-05 updated cvss 5.9

Motorola Solutions MDLC

  • Motorola Solutions MDLC 4.80.0024, 4.82.004, 4.83.001
    affected: vendor fix, mitigation “For user guide and procedural information mentioned within this report, use the Contact Us form and select “Other” for Product Interest and request the manual for IoT products.” motorolasolutions.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.