CVE-2022-29953: Bakerhughes Bently Nevada 3701/40 Firmware

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.

Affected products

• Bakerhughes Bently Nevada 3701/40 Firmware: before 4.1 (fixed in 4.1)
• Bakerhughes Bently Nevada 3701/44 Firmware: before 4.1 (fixed in 4.1)
• Bakerhughes Bently Nevada 3701/46 Firmware: before 4.1 (fixed in 4.1)
• Bakerhughes Bently Nevada 60m100 Firmware: affected versions not specified

Published 2022-07-26. Last modified 2026-06-17.