Emerson Ovation exposes multiple protocols that do not require authentication, allowing an attacker to alter controller settings or trigger a denial‑of‑service. This weakness, categorized as CWE‑306, means an unauthenticated adversary can change critical configuration parameters or disrupt control system operation, potentially affecting system availability and stability.

The vulnerability affects Emerson Ovation systems. No specific version information is listed, so all deployments of the Ovation platform should be evaluated. Users of older controller models lacking the OCR3000 controller may be at higher risk.

The CVSS score of 9.3 classifies this as a critical threat. The EPSS score is not available, but the vulnerability’s lack of authentication and the likely remote network attack vector suggest a high likelihood of exploitation in environments where Ovation protocols are exposed. The issue is not listed in the CISA KEV catalog at this time, but the combination of a high CVSS and potential network reach makes it a top priority for remediation.