Weak DES Cryptography with Hardcoded Keys in Emerson OpenBSI Exposes Protected Data

Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities.

• Emerson OpenBSI versions before 5.9 are marked affected.
• Emerson OpenBSI 5.9, 5.9 SP1, 5.9 SP2, and 5.9 SP3 are marked affected.
• The source description states coverage through 2022-04-29. No fixed release is supplied, and the status of other branches or releases is not established.

Emerson OpenBSI uses DES with hardcoded cryptographic keys to protect certain system credentials, engineering files, and sensitive utilities. Because the keys are embedded and DES is weak cryptography, a low-privileged local user may be able to recover protected material, although the available evidence does not establish the exact extraction or decryption workflow. The supplied attack characteristics indicate local access, low privileges, no user interaction, and low complexity. OpenBSI is an engineering environment for ControlWave and Bristol Babcock RTUs; the evidence does not show that the RTU firmware itself is vulnerable. The key location, file formats, APIs, and specific decryption path are not established.

The weakness is described as locally reachable on systems running Emerson OpenBSI and is not described as directly exploitable over the network. An attacker requires low privileges, does not need user interaction, and faces low attack complexity. The supplied record does not confirm observed exploitation, public exploit code, a campaign, a victim, or a specific indicator of compromise. Missing exploitation-status fields are not evidence that the vulnerability has not been exploited.

Successful exploitation could disclose system credentials, engineering files, and sensitive utilities protected with DES. Organisational consequences may include loss of confidentiality for technical data and increased risk of follow-on unauthorized access if exposed credentials are reusable elsewhere. The available evidence does not establish data modification, service disruption, or a change in security scope. Actual consequences depend on the protected content and on how the credentials are used in each environment.

• Primary risk: loss of confidentiality for certain system credentials, engineering files, and sensitive utilities protected by OpenBSI.
• Exposed credentials could enable further access to an engineering environment or related assets, but that follow-on outcome is possible rather than established by the available evidence.
• Exposed engineering files could reveal configuration or design information related to control operations, depending on the contents of each installation.
• The supplied assessment identifies a confidentiality impact but does not identify a direct integrity or availability impact.

1. Inventory all Emerson OpenBSI installations and determine whether they are in the branches before 5.9, 5.9, 5.9 SP1, 5.9 SP2, or 5.9 SP3.
2. Apply an Emerson-supported fix when one is confirmed. The available evidence does not name a fixed release or confirm patch availability.
3. Until a fix is confirmed, restrict local access to engineering workstations and separately protect the related credentials, engineering files, and sensitive utilities. This is precautionary defensive guidance, not a confirmed vendor mitigation.
4. Do not treat an unlisted version or branch as safe without verifying it against Emerson support information.

1. Inventory engineering workstations that run Emerson OpenBSI and record the installed version and service pack.
2. Identify OpenBSI installations used to manage or configure ControlWave and Bristol Babcock RTUs.
3. Review local access and read access to the system credentials, engineering files, and sensitive utilities protected by OpenBSI.
4. Where a technical review is possible, verify whether the OpenBSI protection mechanism still uses DES and hardcoded cryptographic keys.
5. Monitor unusual reading or copying of this material as a precaution. No specific log event or IOC is supplied, and the absence of log evidence does not prove that a system is safe.