Search
Find a vulnerability
Search criteria
192 vulnerabilities by emerson
CVE-2022-50930 (GCVE-0-2022-50930)
Vulnerability from nvd – Published: 2026-01-13 22:51 – Updated: 2026-01-14 15:29
VLAI
EPSS
VEX
Title
Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path
Summary
Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem permissions during service startup.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/50745 | exploit |
| https://www.emerson.com/en-us | product |
| https://www.opertek.com/descargar-software/?prc=_326 | product |
| https://www.vulncheck.com/advisories/emerson-pac-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | Emerson PAC Machine Edition |
Affected:
9.80
|
Date Public
2022-02-13 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-50930",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T15:29:44.423568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T15:29:51.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Emerson PAC Machine Edition",
"vendor": "Emerson",
"versions": [
{
"status": "affected",
"version": "9.80"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luis Martinez"
}
],
"datePublic": "2022-02-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem permissions during service startup."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T22:51:58.910Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-50745",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/50745"
},
{
"name": "Emerson Official Homepage",
"tags": [
"product"
],
"url": "https://www.emerson.com/en-us"
},
{
"name": "Software Download Link",
"tags": [
"product"
],
"url": "https://www.opertek.com/descargar-software/?prc=_326"
},
{
"name": "VulnCheck Advisory: Emerson PAC Machine Edition 9.80 Build 8695 - \u0027TrapiServer\u0027 Unquoted Service Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/emerson-pac-machine-edition-build-trapiserver-unquoted-service-path"
}
],
"title": "Emerson PAC Machine Edition 9.80 Build 8695 - \u0027TrapiServer\u0027 Unquoted Service Path",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-50930",
"datePublished": "2026-01-13T22:51:58.910Z",
"dateReserved": "2026-01-11T13:34:26.328Z",
"dateUpdated": "2026-01-14T15:29:51.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-53471 (GCVE-0-2025-53471)
Vulnerability from nvd – Published: 2025-07-10 23:45 – Updated: 2026-06-04 20:45
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Improper Input Validation
Summary
Emerson ValveLink products
receive input or data, but does not validate or incorrectly
validates that the input has the properties that are required to process
the data safely and correctly.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53471",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:29:05.416717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:29:12.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink products \nreceive input or data, but does not validate or incorrectly \nvalidates that the input has the properties that are required to process\n the data safely and correctly."
}
],
"value": "Emerson ValveLink products \nreceive input or data, but does not validate or incorrectly \nvalidates that the input has the properties that are required to process\n the data safely and correctly."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T20:45:43.072Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-189-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Improper Input Validation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-53471",
"datePublished": "2025-07-10T23:45:39.592Z",
"dateReserved": "2025-06-30T14:34:56.244Z",
"dateUpdated": "2026-06-04T20:45:43.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-52579 (GCVE-0-2025-52579)
Vulnerability from nvd – Published: 2025-07-10 23:37 – Updated: 2025-07-11 13:55
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Summary
Emerson ValveLink Products store sensitive information in cleartext in memory. The
sensitive memory might be saved to disk, stored in a core dump, or
remain uncleared if the product crashes, or if the programmer does not
properly clear the memory before freeing it.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:55:09.770121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:55:15.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink Products store sensitive information in cleartext in memory. The \nsensitive memory might be saved to disk, stored in a core dump, or \nremain uncleared if the product crashes, or if the programmer does not \nproperly clear the memory before freeing it."
}
],
"value": "Emerson ValveLink Products store sensitive information in cleartext in memory. The \nsensitive memory might be saved to disk, stored in a core dump, or \nremain uncleared if the product crashes, or if the programmer does not \nproperly clear the memory before freeing it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-316",
"description": "CWE-316",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:47:22.866Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-52579",
"datePublished": "2025-07-10T23:37:21.515Z",
"dateReserved": "2025-06-30T14:34:56.212Z",
"dateUpdated": "2025-07-11T13:55:15.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-50109 (GCVE-0-2025-50109)
Vulnerability from nvd – Published: 2025-07-10 23:39 – Updated: 2025-07-11 13:54
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Summary
Emerson ValveLink Products store
sensitive information in cleartext within a resource that might be accessible to another control sphere.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-50109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:54:46.838203Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:54:53.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink Products store\nsensitive information in cleartext within a resource that might be accessible to another control sphere."
}
],
"value": "Emerson ValveLink Products store\nsensitive information in cleartext within a resource that might be accessible to another control sphere."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-316",
"description": "CWE-316",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:39:11.220Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-50109",
"datePublished": "2025-07-10T23:39:11.220Z",
"dateReserved": "2025-06-30T14:34:56.221Z",
"dateUpdated": "2025-07-11T13:54:53.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-48496 (GCVE-0-2025-48496)
Vulnerability from nvd – Published: 2025-07-10 23:43 – Updated: 2025-07-11 13:54
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Uncontrolled Search Path Element
Summary
Emerson ValveLink products
use a fixed or controlled search path to find resources, but one or
more locations in that path can be under the control of unintended
actors.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:53:53.258810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:54:00.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink products \nuse a fixed or controlled search path to find resources, but one or \nmore locations in that path can be under the control of unintended \nactors."
}
],
"value": "Emerson ValveLink products \nuse a fixed or controlled search path to find resources, but one or \nmore locations in that path can be under the control of unintended \nactors."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:43:33.592Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Uncontrolled Search Path Element",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-48496",
"datePublished": "2025-07-10T23:43:33.592Z",
"dateReserved": "2025-06-30T14:34:56.236Z",
"dateUpdated": "2025-07-11T13:54:00.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-46358 (GCVE-0-2025-46358)
Vulnerability from nvd – Published: 2025-07-10 23:41 – Updated: 2025-07-11 13:54
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Protection Mechanism Failure
Summary
Emerson ValveLink products
do not use or incorrectly uses a protection mechanism that provides
sufficient defense against directed attacks against the product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-46358",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:54:19.712968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:54:26.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink products \ndo not use or incorrectly uses a protection mechanism that provides \nsufficient defense against directed attacks against the product."
}
],
"value": "Emerson ValveLink products \ndo not use or incorrectly uses a protection mechanism that provides \nsufficient defense against directed attacks against the product."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:41:25.965Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Protection Mechanism Failure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-46358",
"datePublished": "2025-07-10T23:41:25.965Z",
"dateReserved": "2025-06-30T14:34:56.228Z",
"dateUpdated": "2025-07-11T13:54:26.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50930 (GCVE-0-2022-50930)
Vulnerability from cvelistv5 – Published: 2026-01-13 22:51 – Updated: 2026-01-14 15:29
VLAI
EPSS
VEX
Title
Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path
Summary
Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem permissions during service startup.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/50745 | exploit |
| https://www.emerson.com/en-us | product |
| https://www.opertek.com/descargar-software/?prc=_326 | product |
| https://www.vulncheck.com/advisories/emerson-pac-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | Emerson PAC Machine Edition |
Affected:
9.80
|
Date Public
2022-02-13 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-50930",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T15:29:44.423568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T15:29:51.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Emerson PAC Machine Edition",
"vendor": "Emerson",
"versions": [
{
"status": "affected",
"version": "9.80"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luis Martinez"
}
],
"datePublic": "2022-02-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with LocalSystem permissions during service startup."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T22:51:58.910Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-50745",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/50745"
},
{
"name": "Emerson Official Homepage",
"tags": [
"product"
],
"url": "https://www.emerson.com/en-us"
},
{
"name": "Software Download Link",
"tags": [
"product"
],
"url": "https://www.opertek.com/descargar-software/?prc=_326"
},
{
"name": "VulnCheck Advisory: Emerson PAC Machine Edition 9.80 Build 8695 - \u0027TrapiServer\u0027 Unquoted Service Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/emerson-pac-machine-edition-build-trapiserver-unquoted-service-path"
}
],
"title": "Emerson PAC Machine Edition 9.80 Build 8695 - \u0027TrapiServer\u0027 Unquoted Service Path",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2022-50930",
"datePublished": "2026-01-13T22:51:58.910Z",
"dateReserved": "2026-01-11T13:34:26.328Z",
"dateUpdated": "2026-01-14T15:29:51.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-53471 (GCVE-0-2025-53471)
Vulnerability from cvelistv5 – Published: 2025-07-10 23:45 – Updated: 2026-06-04 20:45
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Improper Input Validation
Summary
Emerson ValveLink products
receive input or data, but does not validate or incorrectly
validates that the input has the properties that are required to process
the data safely and correctly.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
Unaffected: ValveLink 14.0 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53471",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:29:05.416717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:29:12.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "ValveLink 14.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink products \nreceive input or data, but does not validate or incorrectly \nvalidates that the input has the properties that are required to process\n the data safely and correctly."
}
],
"value": "Emerson ValveLink products \nreceive input or data, but does not validate or incorrectly \nvalidates that the input has the properties that are required to process\n the data safely and correctly."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T20:45:43.072Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-189-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Improper Input Validation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-53471",
"datePublished": "2025-07-10T23:45:39.592Z",
"dateReserved": "2025-06-30T14:34:56.244Z",
"dateUpdated": "2026-06-04T20:45:43.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48496 (GCVE-0-2025-48496)
Vulnerability from cvelistv5 – Published: 2025-07-10 23:43 – Updated: 2025-07-11 13:54
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Uncontrolled Search Path Element
Summary
Emerson ValveLink products
use a fixed or controlled search path to find resources, but one or
more locations in that path can be under the control of unintended
actors.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:53:53.258810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:54:00.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink products \nuse a fixed or controlled search path to find resources, but one or \nmore locations in that path can be under the control of unintended \nactors."
}
],
"value": "Emerson ValveLink products \nuse a fixed or controlled search path to find resources, but one or \nmore locations in that path can be under the control of unintended \nactors."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:43:33.592Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Uncontrolled Search Path Element",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-48496",
"datePublished": "2025-07-10T23:43:33.592Z",
"dateReserved": "2025-06-30T14:34:56.236Z",
"dateUpdated": "2025-07-11T13:54:00.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-46358 (GCVE-0-2025-46358)
Vulnerability from cvelistv5 – Published: 2025-07-10 23:41 – Updated: 2025-07-11 13:54
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Protection Mechanism Failure
Summary
Emerson ValveLink products
do not use or incorrectly uses a protection mechanism that provides
sufficient defense against directed attacks against the product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-46358",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:54:19.712968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:54:26.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink products \ndo not use or incorrectly uses a protection mechanism that provides \nsufficient defense against directed attacks against the product."
}
],
"value": "Emerson ValveLink products \ndo not use or incorrectly uses a protection mechanism that provides \nsufficient defense against directed attacks against the product."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:41:25.965Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Protection Mechanism Failure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-46358",
"datePublished": "2025-07-10T23:41:25.965Z",
"dateReserved": "2025-06-30T14:34:56.228Z",
"dateUpdated": "2025-07-11T13:54:26.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-50109 (GCVE-0-2025-50109)
Vulnerability from cvelistv5 – Published: 2025-07-10 23:39 – Updated: 2025-07-11 13:54
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Summary
Emerson ValveLink Products store
sensitive information in cleartext within a resource that might be accessible to another control sphere.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-50109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:54:46.838203Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:54:53.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink Products store\nsensitive information in cleartext within a resource that might be accessible to another control sphere."
}
],
"value": "Emerson ValveLink Products store\nsensitive information in cleartext within a resource that might be accessible to another control sphere."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-316",
"description": "CWE-316",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:39:11.220Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-50109",
"datePublished": "2025-07-10T23:39:11.220Z",
"dateReserved": "2025-06-30T14:34:56.221Z",
"dateUpdated": "2025-07-11T13:54:53.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-52579 (GCVE-0-2025-52579)
Vulnerability from cvelistv5 – Published: 2025-07-10 23:37 – Updated: 2025-07-11 13:55
VLAI
EPSS
VEX
Title
Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Summary
Emerson ValveLink Products store sensitive information in cleartext in memory. The
sensitive memory might be saved to disk, stored in a core dump, or
remain uncleared if the product crashes, or if the programmer does not
properly clear the memory before freeing it.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Emerson | ValveLink SOLO |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink DTM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink PRM |
Affected:
0 , < ValveLink 14.0
(custom)
|
|
| Emerson | ValveLink SNAP-ON |
Affected:
0 , < ValveLink 14.0
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:55:09.770121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:55:15.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ValveLink SOLO",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink DTM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink PRM",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ValveLink SNAP-ON",
"vendor": "Emerson",
"versions": [
{
"lessThan": "ValveLink 14.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emerson reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson ValveLink Products store sensitive information in cleartext in memory. The \nsensitive memory might be saved to disk, stored in a core dump, or \nremain uncleared if the product crashes, or if the programmer does not \nproperly clear the memory before freeing it."
}
],
"value": "Emerson ValveLink Products store sensitive information in cleartext in memory. The \nsensitive memory might be saved to disk, stored in a core dump, or \nremain uncleared if the product crashes, or if the programmer does not \nproperly clear the memory before freeing it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-316",
"description": "CWE-316",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:47:22.866Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01"
},
{
"url": "https://www.emerson.com/en-us/support/security-notifications"
},
{
"url": "https://www.emerson.com/en-us/support/software-downloads-drivers"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/software-downloads-drivers\"\u003ewebsite\u003c/a\u003e\u0026nbsp;.\u003cp\u003eFor more information see the associated \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.emerson.com/en-us/support/security-notifications\"\u003eEmerson security notification.\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Emerson recommends users update their Valvelink software to ValveLink \n14.0 or later. The upgrade can be downloaded from the Emerson website https://www.emerson.com/en-us/support/software-downloads-drivers \u00a0.For more information see the associated Emerson security notification. https://www.emerson.com/en-us/support/security-notifications"
}
],
"source": {
"advisory": "ICSA-25-189-01",
"discovery": "INTERNAL"
},
"title": "Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-52579",
"datePublished": "2025-07-10T23:37:21.515Z",
"dateReserved": "2025-06-30T14:34:56.212Z",
"dateUpdated": "2025-07-11T13:55:15.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-201405-0281
Vulnerability from variot - Updated: 2025-11-18 15:07Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. Emerson DeltaV has a security bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable application. Emerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3 are vulnerable. DeltaV Versions 10.3.1, 11.3, 11.3.1, and 12.3 Can be related to Emerson AMS Device Management version, Emerson AMS Wireless SNAP-ON also.
CVE-2014-2349 - World writable system folder CVE-2014-2350 - Hardcoded credentials
Please find fixes in KBA NK-1400-0031.
Kudos: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov and Timur Yunusov
http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201405-0281",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "12.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "12.3"
}
],
"sources": [
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"db": "BID",
"id": "67596"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-453"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov, and Timur Yunusov.",
"sources": [
{
"db": "BID",
"id": "67596"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2350",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2014-2350",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 2.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.5,
"id": "CVE-2014-2350",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.0,
"vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.5,
"id": "CNVD-2014-03278",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.5,
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.5,
"id": "f73024e8-2351-11e6-abef-000c29c66e3d",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.5,
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2014-2350",
"trust": 1.0,
"value": "LOW"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2014-2350",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2014-2350",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-03278",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201405-453",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-453"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"db": "NVD",
"id": "CVE-2014-2350"
},
{
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. Emerson DeltaV has a security bypass vulnerability. \nAttackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable application. \nEmerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3 are vulnerable. DeltaV Versions 10.3.1, 11.3, 11.3.1, and 12.3\nCan be related to Emerson AMS Device Management version, Emerson AMS\nWireless SNAP-ON also. \n\nCVE-2014-2349 - World writable system folder\nCVE-2014-2350 - Hardcoded credentials\n\nPlease find fixes in KBA NK-1400-0031. \n\nKudos: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov\nand Timur Yunusov\n\n\nhttp://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2350"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"db": "BID",
"id": "67596"
},
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "PACKETSTORM",
"id": "126810"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2350",
"trust": 4.0
},
{
"db": "ICS CERT",
"id": "ICSA-14-133-02",
"trust": 2.7
},
{
"db": "CNVD",
"id": "CNVD-2014-03278",
"trust": 1.2
},
{
"db": "CNNVD",
"id": "CNNVD-201405-453",
"trust": 1.2
},
{
"db": "BID",
"id": "67596",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623",
"trust": 0.8
},
{
"db": "OSVDB",
"id": "107279",
"trust": 0.6
},
{
"db": "IVD",
"id": "E84687A4-1ED5-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "F73024E8-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D70A8D1-463F-11E9-929A-000C29342CB1",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "126810",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"db": "BID",
"id": "67596"
},
{
"db": "PACKETSTORM",
"id": "126810"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-453"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"id": "VAR-201405-0281",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2014-03278"
}
],
"trust": 0.12
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.2
}
],
"sources": [
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2014-03278"
}
]
},
"last_update_date": "2025-11-18T15:07:46.994000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "Emerson DeltaV hard-coded certificate security bypass vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/45903"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.8
},
{
"problemtype": "CWE-798",
"trust": 1.0
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-133-02"
},
{
"trust": 1.0,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-133-02"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2350"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2350"
},
{
"trust": 0.6,
"url": "http://osvdb.com/show/osvdb/107279"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/edservices/automationsystems/deltav/pages/deltavtraining.aspx"
},
{
"trust": 0.3,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-133-02#footnotee_tgc3i2k"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-2350"
},
{
"trust": 0.1,
"url": "http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-2349"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"db": "BID",
"id": "67596"
},
{
"db": "PACKETSTORM",
"id": "126810"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-453"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"db": "BID",
"id": "67596"
},
{
"db": "PACKETSTORM",
"id": "126810"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-453"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-27T00:00:00",
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"date": "2014-05-27T00:00:00",
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-05-27T00:00:00",
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"date": "2014-05-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"date": "2014-05-22T00:00:00",
"db": "BID",
"id": "67596"
},
{
"date": "2014-05-27T04:44:44",
"db": "PACKETSTORM",
"id": "126810"
},
{
"date": "2014-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-453"
},
{
"date": "2014-05-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"date": "2014-05-22T20:55:06.440000",
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03278"
},
{
"date": "2014-05-22T00:00:00",
"db": "BID",
"id": "67596"
},
{
"date": "2014-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-453"
},
{
"date": "2014-05-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002623"
},
{
"date": "2025-10-31T23:15:32.127000",
"db": "NVD",
"id": "CVE-2014-2350"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201405-453"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson DeltaV Vulnerable to access restrictions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002623"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Trust management",
"sources": [
{
"db": "IVD",
"id": "e84687a4-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f73024e8-2351-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d70a8d1-463f-11e9-929a-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-453"
}
],
"trust": 1.2
}
}
VAR-201405-0280
Vulnerability from variot - Updated: 2025-11-18 15:07Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program. Emerson DeltaV Contains vulnerabilities that modify or read configuration files.Engineering level authorization by local user (engineering-level privilege) May be used to modify or read the configuration file. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. Emerson DeltaV has a security bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Emerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3 are vulnerable. DeltaV Versions 10.3.1, 11.3, 11.3.1, and 12.3 Can be related to Emerson AMS Device Management version, Emerson AMS Wireless SNAP-ON also.
CVE-2014-2349 - World writable system folder CVE-2014-2350 - Hardcoded credentials
Please find fixes in KBA NK-1400-0031.
Kudos: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov and Timur Yunusov
http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201405-0280",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 3.3,
"vendor": "emerson",
"version": "12.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.6,
"vendor": "deltav",
"version": "12.3"
}
],
"sources": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"db": "BID",
"id": "67594"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-452"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov, and Timur Yunusov.",
"sources": [
{
"db": "BID",
"id": "67594"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2349",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2014-2349",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.1,
"id": "CVE-2014-2349",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.1,
"id": "CNVD-2014-03277",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.1,
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.1,
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.1,
"id": "f732f984-2351-11e6-abef-000c29c66e3d",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2014-2349",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2014-2349",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-2349",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2014-03277",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201405-452",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-452"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"db": "NVD",
"id": "CVE-2014-2349"
},
{
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program. Emerson DeltaV Contains vulnerabilities that modify or read configuration files.Engineering level authorization by local user (engineering-level privilege) May be used to modify or read the configuration file. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. Emerson DeltaV has a security bypass vulnerability. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. \nEmerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3 are vulnerable. DeltaV Versions 10.3.1, 11.3, 11.3.1, and 12.3\nCan be related to Emerson AMS Device Management version, Emerson AMS\nWireless SNAP-ON also. \n\nCVE-2014-2349 - World writable system folder\nCVE-2014-2350 - Hardcoded credentials\n\nPlease find fixes in KBA NK-1400-0031. \n\nKudos: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov\nand Timur Yunusov\n\n\nhttp://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"db": "BID",
"id": "67594"
},
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "126810"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2349",
"trust": 4.0
},
{
"db": "ICS CERT",
"id": "ICSA-14-133-02",
"trust": 3.3
},
{
"db": "CNVD",
"id": "CNVD-2014-03277",
"trust": 1.2
},
{
"db": "CNNVD",
"id": "CNNVD-201405-452",
"trust": 1.2
},
{
"db": "BID",
"id": "67594",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622",
"trust": 0.8
},
{
"db": "OSVDB",
"id": "107278",
"trust": 0.6
},
{
"db": "IVD",
"id": "7D70CFDE-463F-11E9-83B6-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "EA6FA934-1ED5-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "F732F984-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "126810",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"db": "BID",
"id": "67594"
},
{
"db": "PACKETSTORM",
"id": "126810"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-452"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"id": "VAR-201405-0280",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-03277"
}
],
"trust": 0.12
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-03277"
}
]
},
"last_update_date": "2025-11-18T15:07:46.943000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "Emerson DeltaV \u0027\\\\DeltaV\u0027 directory authorizes security to bypass vulnerability patches",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/45902"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.8
},
{
"problemtype": "CWE-285",
"trust": 1.0
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-133-02"
},
{
"trust": 1.0,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-133-02"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2349"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2349"
},
{
"trust": 0.6,
"url": "http://osvdb.com/show/osvdb/107278"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/edservices/automationsystems/deltav/pages/deltavtraining.aspx"
},
{
"trust": 0.3,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-133-02#footnotee_tgc3i2k"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-2350"
},
{
"trust": 0.1,
"url": "http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-2349"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"db": "BID",
"id": "67594"
},
{
"db": "PACKETSTORM",
"id": "126810"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-452"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"db": "BID",
"id": "67594"
},
{
"db": "PACKETSTORM",
"id": "126810"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-452"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-27T00:00:00",
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"date": "2014-05-27T00:00:00",
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"date": "2014-05-27T00:00:00",
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-05-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"date": "2014-05-22T00:00:00",
"db": "BID",
"id": "67594"
},
{
"date": "2014-05-27T04:44:44",
"db": "PACKETSTORM",
"id": "126810"
},
{
"date": "2014-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-452"
},
{
"date": "2014-05-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"date": "2014-05-22T20:55:06.377000",
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03277"
},
{
"date": "2014-05-22T00:00:00",
"db": "BID",
"id": "67594"
},
{
"date": "2014-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-452"
},
{
"date": "2014-05-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002622"
},
{
"date": "2025-10-31T23:15:31.537000",
"db": "NVD",
"id": "CVE-2014-2349"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "67594"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-452"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson DeltaV \u0027\\DeltaV\u0027 Directory Authorization Security Bypass Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
},
{
"db": "BID",
"id": "67594"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Permission permission and access control",
"sources": [
{
"db": "IVD",
"id": "7d70cfde-463f-11e9-83b6-000c29342cb1"
},
{
"db": "IVD",
"id": "ea6fa934-1ed5-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "f732f984-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 0.6
}
}
VAR-201702-0850
Vulnerability from variot - Updated: 2025-04-20 23:29An issue was discovered in Emerson SE4801T0X Redundant Wireless I/O Card V13.3, and SE4801T1X Simplex Wireless I/O Card V13.3. DeltaV Wireless I/O Cards (WIOC) running the firmware available in the DeltaV system, release v13.3, have the SSH (Secure Shell) functionality enabled unnecessarily. EmersonSE4801T0XRedundantWirelessI/OCard and SE4801T1XSimplexWirelessI/OCard are wireless I/O cards from Emerson Electric, Inc., which are used to connect workstations and servers in DeltaV (software for process control) networks. A security vulnerability exists in EmersonSE4801T0XRedundantWirelessI/OCardV13.3 and SE4801T1XSimplexWirelessI/OCardV13.3. A remote attacker could exploit the vulnerability to access the device's file system by using an open port. Multiple Emerson products are prone to a security-bypass vulnerability. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201702-0850",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "se4801t1x simplex wireless i/o card",
"scope": "eq",
"trust": 1.7,
"vendor": "emerson",
"version": "13.3"
},
{
"model": "se4801t0x redundant wireless i/o card",
"scope": "eq",
"trust": 1.7,
"vendor": "emerson",
"version": "13.3"
},
{
"model": "se4801t0x redundant wireless i\\/o card",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "13.3"
},
{
"model": "se4801t1x simplex wireless i\\/o card",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "13.3"
},
{
"model": "se4801t0x redundant wireless i/o card",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "se4801t1x simplex wireless i/o card",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "se4801t0x redundant i o card",
"version": "13.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "se4801t1x simplex i o card",
"version": "13.3"
}
],
"sources": [
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "BID",
"id": "94586"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
},
{
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:emerson:se4801t0x_redundant_wireless_i%2Fo_card",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:emerson:se4801t0x_redundant_wireless_i%2Fo_card_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:se4801t1x_simplex_wireless_i%2Fo_card",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:emerson:se4801t1x_simplex_wireless_i%2Fo_card_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "94586"
}
],
"trust": 0.3
},
"cve": "CVE-2016-9347",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2016-9347",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "CNVD-2016-11896",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-98167",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.6,
"id": "CVE-2016-9347",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-9347",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2016-9347",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2016-11896",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201611-705",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-98167",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "VULHUB",
"id": "VHN-98167"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
},
{
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Emerson SE4801T0X Redundant Wireless I/O Card V13.3, and SE4801T1X Simplex Wireless I/O Card V13.3. DeltaV Wireless I/O Cards (WIOC) running the firmware available in the DeltaV system, release v13.3, have the SSH (Secure Shell) functionality enabled unnecessarily. EmersonSE4801T0XRedundantWirelessI/OCard and SE4801T1XSimplexWirelessI/OCard are wireless I/O cards from Emerson Electric, Inc., which are used to connect workstations and servers in DeltaV (software for process control) networks. A security vulnerability exists in EmersonSE4801T0XRedundantWirelessI/OCardV13.3 and SE4801T1XSimplexWirelessI/OCardV13.3. A remote attacker could exploit the vulnerability to access the device\u0027s file system by using an open port. Multiple Emerson products are prone to a security-bypass vulnerability. \nAn attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-9347"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "BID",
"id": "94586"
},
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "VULHUB",
"id": "VHN-98167"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-9347",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-16-334-03",
"trust": 3.4
},
{
"db": "BID",
"id": "94586",
"trust": 2.6
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2016-11896",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965",
"trust": 0.8
},
{
"db": "IVD",
"id": "A3B16A9F-D6C5-455D-B34F-EA13CB0F0B9B",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-98167",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "VULHUB",
"id": "VHN-98167"
},
{
"db": "BID",
"id": "94586"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
},
{
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"id": "VAR-201702-0850",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "VULHUB",
"id": "VHN-98167"
}
],
"trust": 1.5666666999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "CNVD",
"id": "CNVD-2016-11896"
}
]
},
"last_update_date": "2025-04-20T23:29:44.921000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "Patches for multiple Emerson product security bypass vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/85021"
},
{
"title": "Emerson SE4801T0X Redundant Wireless I/O Card and SE4801T1X Simplex Wireless I/O Card Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65972"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-254",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98167"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-334-03"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/94586"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9347"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9347"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/edservices/automationsystems/deltav/pages/deltavtraining.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "VULHUB",
"id": "VHN-98167"
},
{
"db": "BID",
"id": "94586"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
},
{
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"db": "VULHUB",
"id": "VHN-98167"
},
{
"db": "BID",
"id": "94586"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
},
{
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-06T00:00:00",
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"date": "2016-12-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"date": "2017-02-13T00:00:00",
"db": "VULHUB",
"id": "VHN-98167"
},
{
"date": "2016-11-29T00:00:00",
"db": "BID",
"id": "94586"
},
{
"date": "2017-04-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"date": "2016-11-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-705"
},
{
"date": "2017-02-13T21:59:01.830000",
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-11896"
},
{
"date": "2017-03-13T00:00:00",
"db": "VULHUB",
"id": "VHN-98167"
},
{
"date": "2016-12-20T00:04:00",
"db": "BID",
"id": "94586"
},
{
"date": "2017-04-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007965"
},
{
"date": "2016-12-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-705"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2016-9347"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson SE4801T0X Redundant and SE4801T1X Simplex Wireless I/O Card In the firmware SSH Vulnerabilities whose features are unnecessarily enabled",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007965"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "IVD",
"id": "a3b16a9f-d6c5-455d-b34f-ea13cb0f0b9b"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-705"
}
],
"trust": 0.8
}
}
VAR-201702-0848
Vulnerability from variot - Updated: 2025-04-20 23:25An issue was discovered in Emerson DeltaV Easy Security Management DeltaV V12.3, DeltaV V12.3.1, and DeltaV V13.3. Critical vulnerabilities may allow a local attacker to elevate privileges within the DeltaV control system. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. There is an elevation of privilege vulnerability in Emerson DeltaV
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201702-0848",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav",
"scope": "eq",
"trust": 2.7,
"vendor": "emerson",
"version": "13.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 2.7,
"vendor": "emerson",
"version": "12.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 2.7,
"vendor": "emerson",
"version": "12.3"
},
{
"model": "deltav",
"scope": null,
"trust": 0.6,
"vendor": "emerson",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "12.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "12.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "13.3"
}
],
"sources": [
{
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
},
{
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"db": "BID",
"id": "94584"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
},
{
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "94584"
}
],
"trust": 0.3
},
"cve": "CVE-2016-9345",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.4,
"id": "CVE-2016-9345",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2016-11817",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.0,
"id": "CVE-2016-9345",
"impactScore": 5.3,
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-9345",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2016-9345",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2016-11817",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201611-704",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
},
{
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
},
{
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Emerson DeltaV Easy Security Management DeltaV V12.3, DeltaV V12.3.1, and DeltaV V13.3. Critical vulnerabilities may allow a local attacker to elevate privileges within the DeltaV control system. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. There is an elevation of privilege vulnerability in Emerson DeltaV",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-9345"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"db": "BID",
"id": "94584"
},
{
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-9345",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-16-334-02",
"trust": 2.7
},
{
"db": "BID",
"id": "94584",
"trust": 2.5
},
{
"db": "BID",
"id": "105767",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2016-11817",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201611-704",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966",
"trust": 0.8
},
{
"db": "IVD",
"id": "8E3727F3-4C57-46FA-B531-77BA29B04434",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
},
{
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"db": "BID",
"id": "94584"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
},
{
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"id": "VAR-201702-0848",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
},
{
"db": "CNVD",
"id": "CNVD-2016-11817"
}
],
"trust": 0.08
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
},
{
"db": "CNVD",
"id": "CNVD-2016-11817"
}
]
},
"last_update_date": "2025-04-20T23:25:06.873000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "Emerson DeltaV privilege patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/84831"
},
{
"title": "Emerson DeltaV Repair measures for privilege escalation",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65971"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-334-02"
},
{
"trust": 2.2,
"url": "http://www.securityfocus.com/bid/94584"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/105767"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9345"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9345"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/edservices/automationsystems/deltav/pages/deltavtraining.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"db": "BID",
"id": "94584"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
},
{
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
},
{
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"db": "BID",
"id": "94584"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
},
{
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-02T00:00:00",
"db": "IVD",
"id": "8e3727f3-4c57-46fa-b531-77ba29b04434"
},
{
"date": "2016-12-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"date": "2016-11-29T00:00:00",
"db": "BID",
"id": "94584"
},
{
"date": "2017-04-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"date": "2016-11-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-704"
},
{
"date": "2017-02-13T21:59:01.767000",
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-11817"
},
{
"date": "2016-12-20T02:03:00",
"db": "BID",
"id": "94584"
},
{
"date": "2017-04-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007966"
},
{
"date": "2016-12-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-704"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2016-9345"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson DeltaV Easy Security Management Vulnerability in which privileges are elevated",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007966"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201611-704"
}
],
"trust": 0.6
}
}
VAR-201702-0297
Vulnerability from variot - Updated: 2025-04-20 23:05An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network. Emerson Liebert SiteScan Web is a web-based data center monitoring application.
Emerson Liebert SiteScan Web has an information disclosure vulnerability that can be used by remote attackers to submit special requests to obtain sensitive information. Emerson Liebert SiteScan is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. SiteScan Web 6.5 and prior versions are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201702-0297",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "liebert sitescan web",
"scope": "eq",
"trust": 1.5,
"vendor": "emerson",
"version": "6.5"
},
{
"model": "liebert sitescan web",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "6.5"
},
{
"model": "liebert sitescan web",
"scope": "lt",
"trust": 0.8,
"vendor": "emerson",
"version": "6.5"
},
{
"model": "liebert sitescan web",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "6.1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "BID",
"id": "94587"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
},
{
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:liebert_sitescan_web",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Ermakov from Positive Technologies.",
"sources": [
{
"db": "BID",
"id": "94587"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
}
],
"trust": 0.9
},
"cve": "CVE-2016-8348",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-8348",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2016-11968",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-8348",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-8348",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2016-8348",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2016-11968",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201611-702",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
},
{
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network. Emerson Liebert SiteScan Web is a web-based data center monitoring application. \n\nEmerson Liebert SiteScan Web has an information disclosure vulnerability that can be used by remote attackers to submit special requests to obtain sensitive information. Emerson Liebert SiteScan is prone to an information-disclosure vulnerability. \nAn attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. \nSiteScan Web 6.5 and prior versions are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-8348"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "BID",
"id": "94587"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-8348",
"trust": 3.3
},
{
"db": "ICS CERT",
"id": "ICSA-16-334-01",
"trust": 2.7
},
{
"db": "BID",
"id": "94587",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2016-11968",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "BID",
"id": "94587"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
},
{
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"id": "VAR-201702-0297",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
}
],
"trust": 1.2
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
}
]
},
"last_update_date": "2025-04-20T23:05:36.992000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-us"
},
{
"title": "Patch for Emerson Liebert SiteScan Information Disclosure Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/85061"
},
{
"title": "Emerson Liebert SiteScan Repair measures for information disclosure vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65969"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-611",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-334-01"
},
{
"trust": 2.2,
"url": "http://www.securityfocus.com/bid/94587"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8348"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-8348"
},
{
"trust": 0.3,
"url": "http://emerson.com"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "BID",
"id": "94587"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
},
{
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "BID",
"id": "94587"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
},
{
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-07T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"date": "2016-11-29T00:00:00",
"db": "BID",
"id": "94587"
},
{
"date": "2017-03-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"date": "2016-11-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-702"
},
{
"date": "2017-02-13T21:59:00.707000",
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-07T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"date": "2016-12-20T02:03:00",
"db": "BID",
"id": "94587"
},
{
"date": "2017-03-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007830"
},
{
"date": "2016-12-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-702"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2016-8348"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson Liebert SiteScan Information Disclosure Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-11968"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201611-702"
}
],
"trust": 0.6
}
}
VAR-201412-0027
Vulnerability from variot - Updated: 2025-04-13 23:39Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary commands via a TCP replay attack. Supplementary information : CWE Vulnerability type by CWE-77: Improper Neutralization of Special Elements used in a Command ( Command injection ) Has been identified. http://cwe.mitre.org/data/definitions/77.htmlBy a third party TCP Reflex attack ( Replay attack ) An arbitrary command may be executed via. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. Emerson Process Management's ROC800, DL8000 and ROC800L have security bypass vulnerabilities. Allows an attacker to bypass authentication and perform unauthorized operations. The following versions are affected: ROC800 3.50 and prior DL8000 2.30 and prior ROC800L 1.20 and prior. Emerson Process Management ROC800 RTU, DL8000 RTU and ROC800L RTU are all remote terminal unit (RTU) products of Emerson Electric (Emerson Electric) in the United States. Function
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201412-0027",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dl 8000 remote terminal unit",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "2.30"
},
{
"model": "roc 800l remote terminal unit",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "1.20"
},
{
"model": "roc 800 remote terminal unit",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "3.50"
},
{
"model": "roc 800 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "dl 8000 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "roc 800l remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "dl8000 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "dl8000 rtu",
"scope": "lte",
"trust": 0.8,
"vendor": "emerson",
"version": "2.30"
},
{
"model": "roc800 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800 rtu",
"scope": "lte",
"trust": 0.8,
"vendor": "emerson",
"version": "3.50"
},
{
"model": "roc800l rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800l rtu",
"scope": "lte",
"trust": 0.8,
"vendor": "emerson",
"version": "1.20"
},
{
"model": "electric co roc800l",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "1.20"
},
{
"model": "electric co dl8000",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "2.30"
},
{
"model": "electric co roc800",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "3.50"
},
{
"model": "roc 800l remote terminal unit",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "1.20"
},
{
"model": "roc 800 remote terminal unit",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "3.50"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800 remote terminal unit",
"version": "3.50"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "dl 8000 remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800l remote terminal unit",
"version": "1.20"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "dl 8000 remote terminal unit",
"version": "2.30"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800l remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800 remote terminal unit",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-101"
},
{
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:emerson:dl_8000_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:emerson:dl_8000_remote_terminal_unit_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:emerson:roc_800_remote_terminal_unit_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800l_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:emerson:roc_800l_remote_terminal_unit_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dillon Beresford, Brian Meixell, Marc Ayala and Eric Forner of Cimation",
"sources": [
{
"db": "BID",
"id": "71425"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-101"
}
],
"trust": 0.9
},
"cve": "CVE-2013-2810",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2013-2810",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2014-08734",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "b2728756-2351-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-62812",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-2810",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2013-2810",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-08734",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201412-101",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-62812",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "VULHUB",
"id": "VHN-62812"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-101"
},
{
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary commands via a TCP replay attack. Supplementary information : CWE Vulnerability type by CWE-77: Improper Neutralization of Special Elements used in a Command ( Command injection ) Has been identified. http://cwe.mitre.org/data/definitions/77.htmlBy a third party TCP Reflex attack ( Replay attack ) An arbitrary command may be executed via. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. Emerson Process Management\u0027s ROC800, DL8000 and ROC800L have security bypass vulnerabilities. Allows an attacker to bypass authentication and perform unauthorized operations. \nThe following versions are affected:\nROC800 3.50 and prior\nDL8000 2.30 and prior\nROC800L 1.20 and prior. Emerson Process Management ROC800 RTU, DL8000 RTU and ROC800L RTU are all remote terminal unit (RTU) products of Emerson Electric (Emerson Electric) in the United States. Function",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-2810"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "BID",
"id": "71425"
},
{
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-62812"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-2810",
"trust": 3.6
},
{
"db": "BID",
"id": "71425",
"trust": 2.6
},
{
"db": "ICS CERT",
"id": "ICSA-13-259-01A",
"trust": 2.5
},
{
"db": "CNNVD",
"id": "CNNVD-201412-101",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2014-08734",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701",
"trust": 0.8
},
{
"db": "XF",
"id": "99131",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "28611",
"trust": 0.6
},
{
"db": "IVD",
"id": "B2728756-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-62812",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "VULHUB",
"id": "VHN-62812"
},
{
"db": "BID",
"id": "71425"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-101"
},
{
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"id": "VAR-201412-0027",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "VULHUB",
"id": "VHN-62812"
}
],
"trust": 1.9
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-08734"
}
]
},
"last_update_date": "2025-04-13T23:39:08.648000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "Multiple Emerson Process Management RTUs security bypass vulnerability patches",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/52477"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-77",
"trust": 1.1
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-62812"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-13-259-01a"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/71425"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99131"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2810"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-2810"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/99131"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/28611"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "VULHUB",
"id": "VHN-62812"
},
{
"db": "BID",
"id": "71425"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-101"
},
{
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"db": "VULHUB",
"id": "VHN-62812"
},
{
"db": "BID",
"id": "71425"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-101"
},
{
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-05T00:00:00",
"db": "IVD",
"id": "b2728756-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-12-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"date": "2014-12-08T00:00:00",
"db": "VULHUB",
"id": "VHN-62812"
},
{
"date": "2014-12-03T00:00:00",
"db": "BID",
"id": "71425"
},
{
"date": "2014-12-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"date": "2014-12-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-101"
},
{
"date": "2014-12-08T11:59:00.077000",
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-08734"
},
{
"date": "2017-08-29T00:00:00",
"db": "VULHUB",
"id": "VHN-62812"
},
{
"date": "2014-12-24T00:55:00",
"db": "BID",
"id": "71425"
},
{
"date": "2014-12-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-006701"
},
{
"date": "2014-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-101"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2013-2810"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-101"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Emerson Process Management RTU Vulnerability to execute arbitrary commands in product software",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-006701"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "71425"
}
],
"trust": 0.3
}
}
VAR-201505-0070
Vulnerability from variot - Updated: 2025-04-13 23:25SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input. Emerson Electric AMS Device Manager is a set of fixed asset management software. The software provides predictive diagnostics, device configuration management and more. The attacker can submit the malformed input to the affected software. This vulnerability can be used to access the application and its data files with administrator privileges. An authenticated attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201505-0070",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ams device manager",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "12.5"
},
{
"model": "ams device manager",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "12.5"
},
{
"model": "ams device manager",
"scope": "lt",
"trust": 0.8,
"vendor": "emerson",
"version": "13"
},
{
"model": "ams device manager",
"scope": "lte",
"trust": 0.6,
"vendor": "emerson",
"version": "\u003c=12.5"
},
{
"model": "ams device manager",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "12.4"
},
{
"model": "ams device manager",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "12.3"
},
{
"model": "ams device manager",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "12.2"
},
{
"model": "ams device manager",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "12.1"
},
{
"model": "ams device manager",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "12.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ams device manager",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"db": "BID",
"id": "74774"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
},
{
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:ams_device_manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson Process Management",
"sources": [
{
"db": "BID",
"id": "74774"
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
}
],
"trust": 0.9
},
"cve": "CVE-2015-1008",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2015-1008",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.1,
"id": "CNVD-2015-03472",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.1,
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-1008",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2015-1008",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2015-03472",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201505-505",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
},
{
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input. Emerson Electric AMS Device Manager is a set of fixed asset management software. The software provides predictive diagnostics, device configuration management and more. The attacker can submit the malformed input to the affected software. This vulnerability can be used to access the application and its data files with administrator privileges. \nAn authenticated attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-1008"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"db": "BID",
"id": "74774"
},
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-1008",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-15-111-01",
"trust": 3.3
},
{
"db": "BID",
"id": "74774",
"trust": 2.5
},
{
"db": "CNVD",
"id": "CNVD-2015-03472",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810",
"trust": 0.8
},
{
"db": "IVD",
"id": "8EAADD14-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"db": "BID",
"id": "74774"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
},
{
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"id": "VAR-201505-0070",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-03472"
}
],
"trust": 0.08
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-03472"
}
]
},
"last_update_date": "2025-04-13T23:25:14.495000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DSN15003-2 AMS Device Manager SQL Injection Vulnerability",
"trust": 0.8,
"url": "http://community.emerson.com/process/emerson-exchange/operateandmanage/deltav/deltav_security/b/securitynotificationblog/archive/2015/04/16/dsn15003-2-ams-device-management-sql-injection-vulnerability"
},
{
"title": "Emerson AMS Device Manager patch for local SQL injection vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/59067"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-111-01"
},
{
"trust": 1.6,
"url": "http://community.emerson.com/process/emerson-exchange/operateandmanage/deltav/deltav_security/b/securitynotificationblog/archive/2015/04/16/dsn15003-2-ams-device-management-sql-injection-vulnerability"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/74774"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1008"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1008"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/amssuite/amsdevicemanager/pages/amsdevicemanager.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"db": "BID",
"id": "74774"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
},
{
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"db": "BID",
"id": "74774"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
},
{
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-05-29T00:00:00",
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2015-05-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"date": "2015-05-21T00:00:00",
"db": "BID",
"id": "74774"
},
{
"date": "2015-05-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"date": "2015-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201505-505"
},
{
"date": "2015-05-26T01:59:00.180000",
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-05-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-03472"
},
{
"date": "2015-05-21T00:00:00",
"db": "BID",
"id": "74774"
},
{
"date": "2015-05-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-002810"
},
{
"date": "2015-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201505-505"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2015-1008"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson AMS Device Manager In SQL Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-002810"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection",
"sources": [
{
"db": "IVD",
"id": "8eaadd14-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201505-505"
}
],
"trust": 0.8
}
}
VAR-201501-0399
Vulnerability from variot - Updated: 2025-04-13 23:04The CodeWrights HART Device Type Manager (DTM) library in Emerson HART DTM before 1.4.181 allows physically proximate attackers to cause a denial of service (DTM outage and FDT Frame application hang) by transmitting crafted response packets on the 4-20 mA current loop. HART Device Type Manager is a device type manager. CodeWrights 'HART DTM' Library has a local denial of service vulnerability that can be exploited by local attackers to initiate a denial of service attack. CodeWrights 'HART DTM' library is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause denial-of-service conditions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201501-0399",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "hart device type manager",
"scope": "lte",
"trust": 1.0,
"vendor": "codewrights",
"version": "1.0.44"
},
{
"model": "hart dtm",
"scope": "lt",
"trust": 0.8,
"vendor": "emerson",
"version": "1.4.181"
},
{
"model": "hart device type manager",
"scope": "lt",
"trust": 0.6,
"vendor": "codewrights",
"version": "1.4.181"
},
{
"model": "hart device type manager",
"scope": "eq",
"trust": 0.6,
"vendor": "codewrights",
"version": "1.0.44"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "hart device type manager",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
},
{
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:hart_device_type_manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alexander Bolshev",
"sources": [
{
"db": "BID",
"id": "71952"
}
],
"trust": 0.3
},
"cve": "CVE-2014-9191",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2014-9191",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CNVD-2015-00263",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-9191",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "CVE-2014-9191",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNVD",
"id": "CNVD-2015-00263",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201501-202",
"trust": 0.6,
"value": "LOW"
},
{
"author": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
},
{
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The CodeWrights HART Device Type Manager (DTM) library in Emerson HART DTM before 1.4.181 allows physically proximate attackers to cause a denial of service (DTM outage and FDT Frame application hang) by transmitting crafted response packets on the 4-20 mA current loop. HART Device Type Manager is a device type manager. CodeWrights \u0027HART DTM\u0027 Library has a local denial of service vulnerability that can be exploited by local attackers to initiate a denial of service attack. CodeWrights \u0027HART DTM\u0027 library is prone to a denial-of-service vulnerability. \nAn attacker may exploit this issue to cause denial-of-service conditions",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-9191"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"db": "BID",
"id": "71952"
},
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-9191",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-15-008-01A",
"trust": 2.4
},
{
"db": "ICS CERT",
"id": "ICSA-15-237-01",
"trust": 2.1
},
{
"db": "BID",
"id": "71952",
"trust": 1.9
},
{
"db": "ICS CERT",
"id": "ICSA-15-048-03",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2015-00263",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU96347573",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-15-008-01",
"trust": 0.3
},
{
"db": "ICS CERT",
"id": "ICSA-15-012-01A",
"trust": 0.3
},
{
"db": "ICS CERT",
"id": "ICSA-15-012-01B",
"trust": 0.3
},
{
"db": "ICS CERT",
"id": "ICSA-15-036-02",
"trust": 0.3
},
{
"db": "ICS CERT",
"id": "ICSA-15-069-02",
"trust": 0.3
},
{
"db": "ICS CERT",
"id": "ICSA-15-029-01",
"trust": 0.3
},
{
"db": "ICS CERT",
"id": "ICSA-15-027-01",
"trust": 0.3
},
{
"db": "ICS CERT",
"id": "ICSA-15-012-01",
"trust": 0.3
},
{
"db": "IVD",
"id": "AABDFA2C-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"db": "BID",
"id": "71952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
},
{
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"id": "VAR-201501-0399",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
}
],
"trust": 1.4666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
}
]
},
"last_update_date": "2025-04-13T23:04:38.119000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "EMR.EPM14001-1A",
"trust": 0.8,
"url": "http://www2.emersonprocess.com/siteadmincenter/PM%20Central%20Web%20Documents/EMR%20EPM14001-1.pdf"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "YSAR-15-0001: \u6a2a\u6cb3\u88fd\u54c1\u306e HART Device DTM\u306b\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027",
"trust": 0.8,
"url": "http://www.yokogawa.co.jp/dcs/security/ysar/YSAR-15-0001.pdf"
},
{
"title": "CodeWrights \u0027HART DTM\u0027 Library Patch for Local Denial of Service Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/53962"
},
{
"title": "Rosemount_644_Temperature_Transmitter_8_HART_000026_0018_8_DD1_4_181_4_DTM",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=53330"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-008-01a"
},
{
"trust": 2.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-237-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/71952"
},
{
"trust": 1.6,
"url": "http://www2.emersonprocess.com/siteadmincenter/pm%20central%20web%20documents/emr%20epm14001-1.pdf"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9191"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9191"
},
{
"trust": 0.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-048-03"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu96347573/"
},
{
"trust": 0.3,
"url": "http://www1.codewrights.biz/site/index.php/en/our-offering/for-end-users/hart-commdtm "
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-012-01a"
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-027-01"
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-036-02"
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-048-03#footnotec_6z1l450"
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-069-02"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/siteadmincenter/pm%20central%20web%20documents/emr%20epm14001-1.pdf "
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-008-01-0 "
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-012-01 "
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-012-01b "
},
{
"trust": 0.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-029-01 "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"db": "BID",
"id": "71952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
},
{
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"db": "BID",
"id": "71952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
},
{
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-14T00:00:00",
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2015-01-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"date": "2015-01-08T00:00:00",
"db": "BID",
"id": "71952"
},
{
"date": "2015-01-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"date": "2015-01-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201501-202"
},
{
"date": "2015-01-10T02:59:34.693000",
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-00263"
},
{
"date": "2015-11-03T19:18:00",
"db": "BID",
"id": "71952"
},
{
"date": "2015-09-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007577"
},
{
"date": "2015-01-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201501-202"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-9191"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CodeWrights \u0027HART DTM\u0027 Library Local Denial of Service Vulnerability",
"sources": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-00263"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Resource management error",
"sources": [
{
"db": "IVD",
"id": "aabdfa2c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201501-202"
}
],
"trust": 0.8
}
}
VAR-201303-0017
Vulnerability from variot - Updated: 2025-04-11 23:15The Emerson DeltaV SE3006 through 11.3.1, DeltaV VE3005 through 10.3.1 and 11.x through 11.3.1, and DeltaV VE3006 through 10.3.1 and 11.x through 11.3.1 allow remote attackers to cause a denial of service (device restart) via a crafted packet on (1) TCP port 23, (2) UDP port 161, or (3) TCP port 513. Emerson Deltav is a distributed control system. Emerson Deltav has a security hole in handling certain messages. Allows an attacker to exploit the vulnerability to restart the controller, causing a denial of service attack. Emerson DeltaV is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to consume available resources and crash the application, denying service to legitimate users. The following are vulnerable: DeltaV SE3006 SD Plus Controller versions 11.3.1 and prior DeltaV VE3005 Controller MD Hardware versions 10.3.1 and prior DeltaV VE3005 Controller MD Hardware versions 11.3.1 and prior DeltaV VE3006 Controller MD PLUS Hardware versions 10.3.1 and prior DeltaV VE3006 Controller MD PLUS Hardware versions 11.3.1 and prior
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201303-0017",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav se3006 sd plus controller",
"scope": "lte",
"trust": 1.8,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav ve3005 controller md",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav ve3006 controller md plus",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav ve3005 controller md",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav ve3006 controller md plus",
"scope": "lte",
"trust": 1.0,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav ve3005 controller md hardware",
"scope": "lte",
"trust": 0.8,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav ve3005 controller md hardware",
"scope": "lte",
"trust": 0.8,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav ve3006 controller md plus hardware",
"scope": "lte",
"trust": 0.8,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav ve3006 controller md plus hardware",
"scope": "lte",
"trust": 0.8,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "11.x"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "10.x"
},
{
"model": "deltav ve3006 controller md plus",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav ve3006 controller md plus",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav se3006 sd plus controller",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav ve3005 controller md",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav ve3005 controller md",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "deltav ve3005 controller md",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "deltav ve3006 controller md plus",
"version": "*"
},
{
"model": "electric co deltav ve3006 controller md plus hardware",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "electric co deltav ve3006 controller md plus hardware",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav ve3005 controller md hardware",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "electric co deltav ve3005 controller md hardware",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav se3006 sd plus controller",
"scope": "eq",
"trust": 0.3,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav se3006 sd plus controller",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"db": "BID",
"id": "58366"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
},
{
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav_se3006_sd_plus_controller",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_ve3005_controller_md",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_ve3006_controller_md_plus",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Langill",
"sources": [
{
"db": "BID",
"id": "58366"
}
],
"trust": 0.3
},
"cve": "CVE-2012-4703",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 6.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"id": "CVE-2012-4703",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"id": "0dba175e-2353-11e6-abef-000c29c66e3d",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-4703",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-4703",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201303-143",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
},
{
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Emerson DeltaV SE3006 through 11.3.1, DeltaV VE3005 through 10.3.1 and 11.x through 11.3.1, and DeltaV VE3006 through 10.3.1 and 11.x through 11.3.1 allow remote attackers to cause a denial of service (device restart) via a crafted packet on (1) TCP port 23, (2) UDP port 161, or (3) TCP port 513. Emerson Deltav is a distributed control system. Emerson Deltav has a security hole in handling certain messages. Allows an attacker to exploit the vulnerability to restart the controller, causing a denial of service attack. Emerson DeltaV is prone to a remote denial-of-service vulnerability. \nAn attacker can exploit this issue to consume available resources and crash the application, denying service to legitimate users. \nThe following are vulnerable:\nDeltaV SE3006 SD Plus Controller versions 11.3.1 and prior\nDeltaV VE3005 Controller MD Hardware versions 10.3.1 and prior\nDeltaV VE3005 Controller MD Hardware versions 11.3.1 and prior\nDeltaV VE3006 Controller MD PLUS Hardware versions 10.3.1 and prior\nDeltaV VE3006 Controller MD PLUS Hardware versions 11.3.1 and prior",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-4703"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"db": "BID",
"id": "58366"
},
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-4703",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-13-053-01",
"trust": 3.3
},
{
"db": "CNVD",
"id": "CNVD-2013-01690",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "52486",
"trust": 0.6
},
{
"db": "BID",
"id": "58366",
"trust": 0.3
},
{
"db": "IVD",
"id": "0DBA175E-2353-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"db": "BID",
"id": "58366"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
},
{
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"id": "VAR-201303-0017",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-01690"
}
],
"trust": 1.68461536
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-01690"
}
]
},
"last_update_date": "2025-04-11T23:15:26.984000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-US/Pages/default.aspx"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "Emerson DeltaV denial of service vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/32712"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "http://ics-cert.us-cert.gov/pdf/icsa-13-053-01.pdf"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4703"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4703"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/52486"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/edservices/automationsystems/deltav/pages/deltavtraining.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"db": "BID",
"id": "58366"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
},
{
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"db": "BID",
"id": "58366"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
},
{
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-03-11T00:00:00",
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"date": "2013-03-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"date": "2013-03-06T00:00:00",
"db": "BID",
"id": "58366"
},
{
"date": "2013-03-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"date": "2013-03-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201303-143"
},
{
"date": "2013-03-11T21:55:02.417000",
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-03-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"date": "2013-03-06T00:00:00",
"db": "BID",
"id": "58366"
},
{
"date": "2013-03-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-001866"
},
{
"date": "2013-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201303-143"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-4703"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson DeltaV Denial of service vulnerability",
"sources": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-01690"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Resource management error",
"sources": [
{
"db": "IVD",
"id": "0dba175e-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201303-143"
}
],
"trust": 0.8
}
}
VAR-201206-0258
Vulnerability from variot - Updated: 2025-04-11 22:53SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple Emerson Electric DeltaV products incorrectly filter user-submitted input, and an attacker can exploit a vulnerability for SQL injection attacks to obtain database information or control applications. Multiple DeltaV Products are prone to multiple remote vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim's computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: DeltaV Products Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA49210
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49210/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
RELEASE DATE: 2012-05-17
DISCUSS ADVISORY: http://secunia.com/advisories/49210/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49210/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in DeltaV products, which can be exploited by malicious people to conduct cross-site scripting attacks, SQL injection attacks, cause a DoS (Denial of Service), and compromise a vulnerable system.
1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Certain unspecified input is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
3) An error within PORTSERV.exe can be exploited to cause a crash via a specially crafted packet sent to TCP or UDP port 111.
4) An error within the processing of certain fields in project files can be exploited to cause a buffer overflow via a specially crafted project file.
5) An insecure method within an ActiveX control can be exploited to overwrite arbitrary files.
Successful exploitation of vulnerabilities #4 and #5 may allow execution of arbitrary code.
The vulnerabilities are reported in the following applications: * DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and 11.3.1 * DeltaV ProEssentials Scientific Graph version 5.0.0.6
SOLUTION: Apply hotfix (please contact the vendor for more information).
PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute.
ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201206-0258",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "5"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav proessentials scientific graph",
"version": "5.0.0.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3.1"
}
],
"sources": [
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-319"
},
{
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_proessentials_scientific_graph",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_workstation",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kuang-Chun Hung of Security Research and Service Institute.",
"sources": [
{
"db": "BID",
"id": "53591"
}
],
"trust": 0.3
},
"cve": "CVE-2012-1815",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2012-1815",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-1815",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2012-1815",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-319",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-319"
},
{
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple Emerson Electric DeltaV products incorrectly filter user-submitted input, and an attacker can exploit a vulnerability for SQL injection attacks to obtain database information or control applications. Multiple DeltaV Products are prone to multiple remote vulnerabilities. \nExploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim\u0027s computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nDeltaV Products Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA49210\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49210/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nRELEASE DATE:\n2012-05-17\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49210/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49210/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in DeltaV products, which\ncan be exploited by malicious people to conduct cross-site scripting\nattacks, SQL injection attacks, cause a DoS (Denial of Service), and\ncompromise a vulnerable system. \n\n1) Certain unspecified input is not properly sanitised before being\nreturned to the user. This can be exploited to execute arbitrary HTML\nand script code in a user\u0027s browser session in context of an affected\nsite. \n\n2) Certain unspecified input is not properly sanitised before being\nused in SQL queries. This can be exploited to manipulate SQL queries\nby injecting arbitrary SQL code. \n\n3) An error within PORTSERV.exe can be exploited to cause a crash via\na specially crafted packet sent to TCP or UDP port 111. \n\n4) An error within the processing of certain fields in project files\ncan be exploited to cause a buffer overflow via a specially crafted\nproject file. \n\n5) An insecure method within an ActiveX control can be exploited to\noverwrite arbitrary files. \n\nSuccessful exploitation of vulnerabilities #4 and #5 may allow\nexecution of arbitrary code. \n\nThe vulnerabilities are reported in the following applications:\n* DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and\n11.3.1\n* DeltaV ProEssentials Scientific Graph version 5.0.0.6\n\nSOLUTION:\nApply hotfix (please contact the vendor for more information). \n\nPROVIDED AND/OR DISCOVERED BY:\nICS-CERT credits Kuang-Chun Hung, Security Research and Service\nInstitute. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1815"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "112840"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1815",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-12-138-01",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "49210",
"trust": 1.8
},
{
"db": "BID",
"id": "53591",
"trust": 1.3
},
{
"db": "OSVDB",
"id": "82011",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2012-2637",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-319",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-12-137-01",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "19718",
"trust": 0.6
},
{
"db": "IVD",
"id": "C51B3A36-2353-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "112840",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-319"
},
{
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"id": "VAR-201206-0258",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2637"
}
],
"trust": 1.6067765666666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2637"
}
]
},
"last_update_date": "2025-04-11T22:53:41.984000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DeltaV Workstation Hardware",
"trust": 0.8,
"url": "http://www2.emersonprocess.com/siteadmincenter/PM%20DeltaV%20Documents/ProductDataSheets/PDS_WkstationHdware.pdf"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-US/Pages/default.aspx"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "DeltaV multiple product SQL injection vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/23445"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-138-01.pdf"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49210"
},
{
"trust": 1.0,
"url": "http://osvdb.org/82011"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/53591"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1815"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1815"
},
{
"trust": 0.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-137-01.pdf"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/19718"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-319"
},
{
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-319"
},
{
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"date": "2012-05-16T00:00:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"date": "2012-05-18T06:07:17",
"db": "PACKETSTORM",
"id": "112840"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-319"
},
{
"date": "2012-06-08T18:55:01.567000",
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2637"
},
{
"date": "2012-05-30T22:50:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002654"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-319"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-1815"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-319"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson of DeltaV In product SQL Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002654"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection",
"sources": [
{
"db": "IVD",
"id": "c51b3a36-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-319"
}
],
"trust": 0.8
}
}
VAR-201210-0173
Vulnerability from variot - Updated: 2025-04-11 22:53Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service (daemon crash) via a long string to an unspecified port. Emerson DeltaV is a digital engineering control system developed by Emerson. Emerson DeltaV failed to properly filter the input in the project file, and illegal information in some fields can crash the program or be used to execute arbitrary code. Emerson DeltaV is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to cause a crash, denying service to legitimate users. Emerson DeltaV 9.3.1, 10.3.1, 11.3, and 11.3.1 are vulnerable. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Emerson DeltaV Denial of Service Vulnerability
SECUNIA ADVISORY ID: SA50823
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50823/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50823
RELEASE DATE: 2012-10-01
DISCUSS ADVISORY: http://secunia.com/advisories/50823/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/50823/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50823
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: A vulnerability has been reported in DeltaV, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error when processing certain packets and can be exploited to cause a buffer overflow and crash the application.
The vulnerability is reported in versions 9.3.1, 10.3.1, 11.3, and 11.3.1.
SOLUTION: Reportedly a hotfix has been released. Contact the vendor for further information.
PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute.
ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-265-01.pdf
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201210-0173",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav",
"scope": "eq",
"trust": 2.4,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "10.3 to 11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3.1"
}
],
"sources": [
{
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"db": "BID",
"id": "55719"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
},
{
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kuang-Chun Hung of the Security Research and Service Institute-Information and Communication Security Technology Center (ICST)",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
}
],
"trust": 0.6
},
"cve": "CVE-2012-3035",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2012-3035",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "565409ac-2353-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-3035",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-3035",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201209-727",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
},
{
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service (daemon crash) via a long string to an unspecified port. Emerson DeltaV is a digital engineering control system developed by Emerson. Emerson DeltaV failed to properly filter the input in the project file, and illegal information in some fields can crash the program or be used to execute arbitrary code. Emerson DeltaV is prone to a buffer-overflow vulnerability. \nAn attacker can exploit this issue to cause a crash, denying service to legitimate users. \nEmerson DeltaV 9.3.1, 10.3.1, 11.3, and 11.3.1 are vulnerable. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nEmerson DeltaV Denial of Service Vulnerability\n\nSECUNIA ADVISORY ID:\nSA50823\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/50823/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50823\n\nRELEASE DATE:\n2012-10-01\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/50823/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/50823/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50823\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in DeltaV, which can be exploited\nby malicious people to cause a DoS (Denial of Service). \n\nThe vulnerability is caused due to an error when processing certain\npackets and can be exploited to cause a buffer overflow and crash the\napplication. \n\nThe vulnerability is reported in versions 9.3.1, 10.3.1, 11.3, and\n11.3.1. \n\nSOLUTION:\nReportedly a hotfix has been released. Contact the vendor for further\ninformation. \n\nPROVIDED AND/OR DISCOVERED BY:\nICS-CERT credits Kuang-Chun Hung, Security Research and Service\nInstitute. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-265-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-3035"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"db": "BID",
"id": "55719"
},
{
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "117029"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-3035",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-12-265-01",
"trust": 1.9
},
{
"db": "BID",
"id": "55719",
"trust": 1.3
},
{
"db": "CNVD",
"id": "CNVD-2012-5529",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201209-727",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-12-138-01",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "47144",
"trust": 0.6
},
{
"db": "IVD",
"id": "565409AC-2353-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "SECUNIA",
"id": "50823",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "117029",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"db": "BID",
"id": "55719"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "PACKETSTORM",
"id": "117029"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
},
{
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"id": "VAR-201210-0173",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-5529"
}
],
"trust": 1.68461536
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-5529"
}
]
},
"last_update_date": "2025-04-11T22:53:41.944000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-US/Pages/default.aspx"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "Patch for Emerson DeltaV Buffer Overflow Vulnerability (CNVD-2012-5529)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/23449"
},
{
"title": "Emerson DeltaV Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=123573"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-265-01.pdf"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78972"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/55719"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3035"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-3035"
},
{
"trust": 0.6,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-138-01.pdf"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/47144"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50823"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50823/"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50823/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "PACKETSTORM",
"id": "117029"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
},
{
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"db": "BID",
"id": "55719"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"db": "PACKETSTORM",
"id": "117029"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
},
{
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-10-08T00:00:00",
"db": "IVD",
"id": "565409ac-2353-11e6-abef-000c29c66e3d"
},
{
"date": "2012-10-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"date": "2012-09-28T00:00:00",
"db": "BID",
"id": "55719"
},
{
"date": "2012-10-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"date": "2012-10-01T06:11:44",
"db": "PACKETSTORM",
"id": "117029"
},
{
"date": "2012-09-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201209-727"
},
{
"date": "2012-10-01T18:55:00.923000",
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-10-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-5529"
},
{
"date": "2012-09-28T00:00:00",
"db": "BID",
"id": "55719"
},
{
"date": "2012-10-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-004667"
},
{
"date": "2020-07-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201209-727"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-3035"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson DeltaV Vulnerable to buffer overflow",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004667"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201209-727"
}
],
"trust": 0.6
}
}
VAR-201206-0259
Vulnerability from variot - Updated: 2025-04-11 22:53PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) TCP or (2) UDP packet to port 111. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple DeltaV Products are prone to multiple remote vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim's computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: DeltaV Products Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA49210
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49210/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
RELEASE DATE: 2012-05-17
DISCUSS ADVISORY: http://secunia.com/advisories/49210/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49210/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in DeltaV products, which can be exploited by malicious people to conduct cross-site scripting attacks, SQL injection attacks, cause a DoS (Denial of Service), and compromise a vulnerable system.
1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Certain unspecified input is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
4) An error within the processing of certain fields in project files can be exploited to cause a buffer overflow via a specially crafted project file.
5) An insecure method within an ActiveX control can be exploited to overwrite arbitrary files.
Successful exploitation of vulnerabilities #4 and #5 may allow execution of arbitrary code.
The vulnerabilities are reported in the following applications: * DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and 11.3.1 * DeltaV ProEssentials Scientific Graph version 5.0.0.6
SOLUTION: Apply hotfix (please contact the vendor for more information).
PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute.
ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201206-0259",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "5"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav proessentials scientific graph",
"version": "5.0.0.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3.1"
}
],
"sources": [
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-320"
},
{
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_proessentials_scientific_graph",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_workstation",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kuang-Chun Hung of Security Research and Service Institute.",
"sources": [
{
"db": "BID",
"id": "53591"
}
],
"trust": 0.3
},
"cve": "CVE-2012-1816",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2012-1816",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-1816",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-1816",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-320",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-320"
},
{
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) TCP or (2) UDP packet to port 111. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple DeltaV Products are prone to multiple remote vulnerabilities. \nExploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim\u0027s computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nDeltaV Products Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA49210\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49210/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nRELEASE DATE:\n2012-05-17\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49210/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49210/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in DeltaV products, which\ncan be exploited by malicious people to conduct cross-site scripting\nattacks, SQL injection attacks, cause a DoS (Denial of Service), and\ncompromise a vulnerable system. \n\n1) Certain unspecified input is not properly sanitised before being\nreturned to the user. This can be exploited to execute arbitrary HTML\nand script code in a user\u0027s browser session in context of an affected\nsite. \n\n2) Certain unspecified input is not properly sanitised before being\nused in SQL queries. This can be exploited to manipulate SQL queries\nby injecting arbitrary SQL code. \n\n4) An error within the processing of certain fields in project files\ncan be exploited to cause a buffer overflow via a specially crafted\nproject file. \n\n5) An insecure method within an ActiveX control can be exploited to\noverwrite arbitrary files. \n\nSuccessful exploitation of vulnerabilities #4 and #5 may allow\nexecution of arbitrary code. \n\nThe vulnerabilities are reported in the following applications:\n* DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and\n11.3.1\n* DeltaV ProEssentials Scientific Graph version 5.0.0.6\n\nSOLUTION:\nApply hotfix (please contact the vendor for more information). \n\nPROVIDED AND/OR DISCOVERED BY:\nICS-CERT credits Kuang-Chun Hung, Security Research and Service\nInstitute. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1816"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "112840"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1816",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-12-138-01",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "49210",
"trust": 1.8
},
{
"db": "BID",
"id": "53591",
"trust": 1.3
},
{
"db": "OSVDB",
"id": "82012",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2012-2639",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-320",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-12-137-01",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "19718",
"trust": 0.6
},
{
"db": "IVD",
"id": "C50F1CCE-2353-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "112840",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-320"
},
{
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"id": "VAR-201206-0259",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2639"
}
],
"trust": 1.6067765666666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2639"
}
]
},
"last_update_date": "2025-04-11T22:53:41.903000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DeltaV Workstation Hardware",
"trust": 0.8,
"url": "http://www2.emersonprocess.com/siteadmincenter/PM%20DeltaV%20Documents/ProductDataSheets/PDS_WkstationHdware.pdf"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-US/Pages/default.aspx"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "Patch for DeltaV Multiple Product Denial of Service Vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/23447"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-138-01.pdf"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49210"
},
{
"trust": 1.0,
"url": "http://osvdb.org/82012"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/53591"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1816"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1816"
},
{
"trust": 0.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-137-01.pdf"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/19718"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-320"
},
{
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-320"
},
{
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"date": "2012-05-16T00:00:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"date": "2012-05-18T06:07:17",
"db": "PACKETSTORM",
"id": "112840"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-320"
},
{
"date": "2012-06-08T18:55:01.610000",
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2639"
},
{
"date": "2012-05-30T22:50:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002655"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-320"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-1816"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-320"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson of DeltaV Product PORTSERV.exe Service disruption in ( Daemon crash ) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002655"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "c50f1cce-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-320"
}
],
"trust": 0.8
}
}
VAR-201206-0261
Vulnerability from variot - Updated: 2025-04-11 22:53An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to overwrite arbitrary files via unknown vectors. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple DeltaV Products are prone to multiple remote vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim's computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: DeltaV Products Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA49210
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49210/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
RELEASE DATE: 2012-05-17
DISCUSS ADVISORY: http://secunia.com/advisories/49210/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49210/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in DeltaV products, which can be exploited by malicious people to conduct cross-site scripting attacks, SQL injection attacks, cause a DoS (Denial of Service), and compromise a vulnerable system.
1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Certain unspecified input is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
3) An error within PORTSERV.exe can be exploited to cause a crash via a specially crafted packet sent to TCP or UDP port 111.
4) An error within the processing of certain fields in project files can be exploited to cause a buffer overflow via a specially crafted project file.
Successful exploitation of vulnerabilities #4 and #5 may allow execution of arbitrary code.
The vulnerabilities are reported in the following applications: * DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and 11.3.1 * DeltaV ProEssentials Scientific Graph version 5.0.0.6
SOLUTION: Apply hotfix (please contact the vendor for more information).
PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute.
ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201206-0261",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "5"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav proessentials scientific graph",
"version": "5.0.0.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3.1"
}
],
"sources": [
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-322"
},
{
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_proessentials_scientific_graph",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_workstation",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kuang-Chun Hung of Security Research and Service Institute.",
"sources": [
{
"db": "BID",
"id": "53591"
}
],
"trust": 0.3
},
"cve": "CVE-2012-1818",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2012-1818",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-1818",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-1818",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-322",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-322"
},
{
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to overwrite arbitrary files via unknown vectors. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple DeltaV Products are prone to multiple remote vulnerabilities. \nExploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim\u0027s computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nDeltaV Products Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA49210\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49210/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nRELEASE DATE:\n2012-05-17\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49210/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49210/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in DeltaV products, which\ncan be exploited by malicious people to conduct cross-site scripting\nattacks, SQL injection attacks, cause a DoS (Denial of Service), and\ncompromise a vulnerable system. \n\n1) Certain unspecified input is not properly sanitised before being\nreturned to the user. This can be exploited to execute arbitrary HTML\nand script code in a user\u0027s browser session in context of an affected\nsite. \n\n2) Certain unspecified input is not properly sanitised before being\nused in SQL queries. This can be exploited to manipulate SQL queries\nby injecting arbitrary SQL code. \n\n3) An error within PORTSERV.exe can be exploited to cause a crash via\na specially crafted packet sent to TCP or UDP port 111. \n\n4) An error within the processing of certain fields in project files\ncan be exploited to cause a buffer overflow via a specially crafted\nproject file. \n\nSuccessful exploitation of vulnerabilities #4 and #5 may allow\nexecution of arbitrary code. \n\nThe vulnerabilities are reported in the following applications:\n* DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and\n11.3.1\n* DeltaV ProEssentials Scientific Graph version 5.0.0.6\n\nSOLUTION:\nApply hotfix (please contact the vendor for more information). \n\nPROVIDED AND/OR DISCOVERED BY:\nICS-CERT credits Kuang-Chun Hung, Security Research and Service\nInstitute. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1818"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "112840"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1818",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-12-138-01",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "49210",
"trust": 1.8
},
{
"db": "BID",
"id": "53591",
"trust": 1.3
},
{
"db": "OSVDB",
"id": "82014",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2012-2643",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-322",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-12-137-01",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "19718",
"trust": 0.6
},
{
"db": "IVD",
"id": "C4F6A3C4-2353-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "112840",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-322"
},
{
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"id": "VAR-201206-0261",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2643"
}
],
"trust": 1.6067765666666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2643"
}
]
},
"last_update_date": "2025-04-11T22:53:41.863000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DeltaV Workstation Hardware",
"trust": 0.8,
"url": "http://www2.emersonprocess.com/siteadmincenter/PM%20DeltaV%20Documents/ProductDataSheets/PDS_WkstationHdware.pdf"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-US/Pages/default.aspx"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "DeltaV Multiple Product File Operation Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/23448"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-138-01.pdf"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49210"
},
{
"trust": 1.0,
"url": "http://osvdb.org/82014"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/53591"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1818"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1818"
},
{
"trust": 0.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-137-01.pdf"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/19718"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-322"
},
{
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-322"
},
{
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"date": "2012-05-16T00:00:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"date": "2012-05-18T06:07:17",
"db": "PACKETSTORM",
"id": "112840"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-322"
},
{
"date": "2012-06-08T18:55:01.707000",
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2643"
},
{
"date": "2012-05-30T22:50:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002657"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-322"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-1818"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-322"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DeltaV Multiple Product File Operation Vulnerabilities",
"sources": [
{
"db": "IVD",
"id": "c4f6a3c4-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2643"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-322"
}
],
"trust": 0.6
}
}
VAR-201206-0260
Vulnerability from variot - Updated: 2025-04-11 22:53Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple DeltaV Products are prone to multiple remote vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim's computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: DeltaV Products Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA49210
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49210/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
RELEASE DATE: 2012-05-17
DISCUSS ADVISORY: http://secunia.com/advisories/49210/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49210/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in DeltaV products, which can be exploited by malicious people to conduct cross-site scripting attacks, SQL injection attacks, cause a DoS (Denial of Service), and compromise a vulnerable system.
1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Certain unspecified input is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
3) An error within PORTSERV.exe can be exploited to cause a crash via a specially crafted packet sent to TCP or UDP port 111.
4) An error within the processing of certain fields in project files can be exploited to cause a buffer overflow via a specially crafted project file.
5) An insecure method within an ActiveX control can be exploited to overwrite arbitrary files.
Successful exploitation of vulnerabilities #4 and #5 may allow execution of arbitrary code.
The vulnerabilities are reported in the following applications: * DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and 11.3.1 * DeltaV ProEssentials Scientific Graph version 5.0.0.6
SOLUTION: Apply hotfix (please contact the vendor for more information).
PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute.
ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201206-0260",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "5"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav proessentials scientific graph",
"version": "5.0.0.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3.1"
}
],
"sources": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
},
{
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_proessentials_scientific_graph",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_workstation",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kuang-Chun Hung of Security Research and Service Institute.",
"sources": [
{
"db": "BID",
"id": "53591"
}
],
"trust": 0.3
},
"cve": "CVE-2012-1817",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2012-1817",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-1817",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2012-1817",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-321",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
},
{
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. Multiple DeltaV Products are prone to multiple remote vulnerabilities. \nExploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim\u0027s computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nDeltaV Products Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA49210\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49210/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nRELEASE DATE:\n2012-05-17\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49210/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49210/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in DeltaV products, which\ncan be exploited by malicious people to conduct cross-site scripting\nattacks, SQL injection attacks, cause a DoS (Denial of Service), and\ncompromise a vulnerable system. \n\n1) Certain unspecified input is not properly sanitised before being\nreturned to the user. This can be exploited to execute arbitrary HTML\nand script code in a user\u0027s browser session in context of an affected\nsite. \n\n2) Certain unspecified input is not properly sanitised before being\nused in SQL queries. This can be exploited to manipulate SQL queries\nby injecting arbitrary SQL code. \n\n3) An error within PORTSERV.exe can be exploited to cause a crash via\na specially crafted packet sent to TCP or UDP port 111. \n\n4) An error within the processing of certain fields in project files\ncan be exploited to cause a buffer overflow via a specially crafted\nproject file. \n\n5) An insecure method within an ActiveX control can be exploited to\noverwrite arbitrary files. \n\nSuccessful exploitation of vulnerabilities #4 and #5 may allow\nexecution of arbitrary code. \n\nThe vulnerabilities are reported in the following applications:\n* DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and\n11.3.1\n* DeltaV ProEssentials Scientific Graph version 5.0.0.6\n\nSOLUTION:\nApply hotfix (please contact the vendor for more information). \n\nPROVIDED AND/OR DISCOVERED BY:\nICS-CERT credits Kuang-Chun Hung, Security Research and Service\nInstitute. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1817"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "112840"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1817",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-12-138-01",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "49210",
"trust": 1.8
},
{
"db": "BID",
"id": "53591",
"trust": 1.3
},
{
"db": "OSVDB",
"id": "82013",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2012-2641",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002656",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-12-137-01",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "19718",
"trust": 0.6
},
{
"db": "IVD",
"id": "C502EB7A-2353-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "112840",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
},
{
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"id": "VAR-201206-0260",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2641"
}
],
"trust": 1.6067765666666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2641"
}
]
},
"last_update_date": "2025-04-11T22:53:41.823000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DeltaV Workstation Hardware",
"trust": 0.8,
"url": "http://www2.emersonprocess.com/siteadmincenter/PM%20DeltaV%20Documents/ProductDataSheets/PDS_WkstationHdware.pdf"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-US/Pages/default.aspx"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-138-01.pdf"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49210"
},
{
"trust": 1.0,
"url": "http://osvdb.org/82013"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/53591"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1817"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1817"
},
{
"trust": 0.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-137-01.pdf"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/19718"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
},
{
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
},
{
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"date": "2012-05-16T00:00:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"date": "2012-05-18T06:07:17",
"db": "PACKETSTORM",
"id": "112840"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-321"
},
{
"date": "2012-06-08T18:55:01.657000",
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"date": "2012-05-30T22:50:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002656"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-321"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-1817"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DeltaV Multiple Product Buffer Overflow Vulnerabilities",
"sources": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2641"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input validation",
"sources": [
{
"db": "IVD",
"id": "c502eb7a-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-321"
}
],
"trust": 0.8
}
}
VAR-201206-0257
Vulnerability from variot - Updated: 2025-04-11 22:53Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. There are cross-site scripting vulnerabilities in multiple Emerson Electric DeltaV products that allow an attacker to exploit a vulnerability to build a malicious web page, entice a user to resolve, obtain sensitive information, or hijack a user session. Multiple DeltaV Products are prone to multiple remote vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim's computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: DeltaV Products Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA49210
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49210/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
RELEASE DATE: 2012-05-17
DISCUSS ADVISORY: http://secunia.com/advisories/49210/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49210/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49210
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in DeltaV products, which can be exploited by malicious people to conduct cross-site scripting attacks, SQL injection attacks, cause a DoS (Denial of Service), and compromise a vulnerable system.
1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Certain unspecified input is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
3) An error within PORTSERV.exe can be exploited to cause a crash via a specially crafted packet sent to TCP or UDP port 111.
4) An error within the processing of certain fields in project files can be exploited to cause a buffer overflow via a specially crafted project file.
5) An insecure method within an ActiveX control can be exploited to overwrite arbitrary files.
Successful exploitation of vulnerabilities #4 and #5 may allow execution of arbitrary code.
The vulnerabilities are reported in the following applications: * DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and 11.3.1 * DeltaV ProEssentials Scientific Graph version 5.0.0.6
SOLUTION: Apply hotfix (please contact the vendor for more information).
PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute.
ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201206-0257",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "9.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 1.6,
"vendor": "emerson",
"version": "10.3.1"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "5"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "11"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "10"
},
{
"model": "electric co deltav workstations",
"scope": "eq",
"trust": 0.9,
"vendor": "emerson",
"version": "9"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": "deltav proessentials scientific graph",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v5.0.0.6"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v10.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v11.3 and v11.3.1"
},
{
"model": "deltav workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "emerson",
"version": "v9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav",
"version": "11.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav proessentials scientific graph",
"version": "5.0.0.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "9.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "10.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "deltav workstation",
"version": "11.3.1"
}
],
"sources": [
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-318"
},
{
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:emerson:deltav",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_proessentials_scientific_graph",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:emerson:deltav_workstation",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kuang-Chun Hung of Security Research and Service Institute.",
"sources": [
{
"db": "BID",
"id": "53591"
}
],
"trust": 0.3
},
"cve": "CVE-2012-1814",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2012-1814",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "c52838a8-2353-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-1814",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-1814",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201205-318",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-318"
},
{
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Emerson Electric is a diversified global manufacturer. Provides network energy, process management, industrial automation, environmental optimization technology, tools and storage. There are cross-site scripting vulnerabilities in multiple Emerson Electric DeltaV products that allow an attacker to exploit a vulnerability to build a malicious web page, entice a user to resolve, obtain sensitive information, or hijack a user session. Multiple DeltaV Products are prone to multiple remote vulnerabilities. \nExploiting these issues could allow an attacker to steal cookie-based authentication credentials, to access or modify data, to exploit latent vulnerabilities in the underlying database, to execute arbitrary code, to overwrite arbitrary files on the victim\u0027s computer in the context of the vulnerable application that is using the ActiveX control (typically Internet Explorer),or to cause a denial-of-service condition. Other attacks are possible. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nDeltaV Products Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA49210\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49210/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nRELEASE DATE:\n2012-05-17\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49210/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49210/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in DeltaV products, which\ncan be exploited by malicious people to conduct cross-site scripting\nattacks, SQL injection attacks, cause a DoS (Denial of Service), and\ncompromise a vulnerable system. \n\n1) Certain unspecified input is not properly sanitised before being\nreturned to the user. This can be exploited to execute arbitrary HTML\nand script code in a user\u0027s browser session in context of an affected\nsite. \n\n2) Certain unspecified input is not properly sanitised before being\nused in SQL queries. This can be exploited to manipulate SQL queries\nby injecting arbitrary SQL code. \n\n3) An error within PORTSERV.exe can be exploited to cause a crash via\na specially crafted packet sent to TCP or UDP port 111. \n\n4) An error within the processing of certain fields in project files\ncan be exploited to cause a buffer overflow via a specially crafted\nproject file. \n\n5) An insecure method within an ActiveX control can be exploited to\noverwrite arbitrary files. \n\nSuccessful exploitation of vulnerabilities #4 and #5 may allow\nexecution of arbitrary code. \n\nThe vulnerabilities are reported in the following applications:\n* DeltaV and DeltaV Workstations versions 9.3.1, 10.3.1, 11.3, and\n11.3.1\n* DeltaV ProEssentials Scientific Graph version 5.0.0.6\n\nSOLUTION:\nApply hotfix (please contact the vendor for more information). \n\nPROVIDED AND/OR DISCOVERED BY:\nICS-CERT credits Kuang-Chun Hung, Security Research and Service\nInstitute. \n\nORIGINAL ADVISORY:\nICS-CERT:\nhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-137-01.pdf\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1814"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "112840"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1814",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-12-138-01",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "49210",
"trust": 1.8
},
{
"db": "BID",
"id": "53591",
"trust": 1.3
},
{
"db": "OSVDB",
"id": "81996",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2012-2636",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201205-318",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-12-137-01",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "19718",
"trust": 0.6
},
{
"db": "IVD",
"id": "C52838A8-2353-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "112840",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-318"
},
{
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"id": "VAR-201206-0257",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2636"
}
],
"trust": 1.6067765666666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2636"
}
]
},
"last_update_date": "2025-04-11T22:53:41.783000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DeltaV Workstation Hardware",
"trust": 0.8,
"url": "http://www2.emersonprocess.com/siteadmincenter/PM%20DeltaV%20Documents/ProductDataSheets/PDS_WkstationHdware.pdf"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.emerson.com/en-US/Pages/default.aspx"
},
{
"title": "\u65e5\u672c\u30a8\u30de\u30bd\u30f3\u682a\u5f0f\u4f1a\u793e",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "\u5206\u6563\u578b\u5236\u5fa1\u30b7\u30b9\u30c6\u30e0\uff08DCS\uff09 DeltaV\u30b7\u30b9\u30c6\u30e0",
"trust": 0.8,
"url": "http://www.emerson.co.jp/div/epm/product5_1.html"
},
{
"title": "Patch for cross-site scripting vulnerabilities in multiple DeltaV products",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/23443"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-138-01.pdf"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49210"
},
{
"trust": 1.0,
"url": "http://osvdb.org/81996"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/53591"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1814"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1814"
},
{
"trust": 0.7,
"url": "http://www.us-cert.gov/control_systems/pdf/icsa-12-137-01.pdf"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/19718"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49210/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49210"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-318"
},
{
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"db": "BID",
"id": "53591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"db": "PACKETSTORM",
"id": "112840"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-318"
},
{
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"date": "2012-05-16T00:00:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"date": "2012-05-18T06:07:17",
"db": "PACKETSTORM",
"id": "112840"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-318"
},
{
"date": "2012-06-08T18:55:01.503000",
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2636"
},
{
"date": "2012-05-30T22:50:00",
"db": "BID",
"id": "53591"
},
{
"date": "2012-06-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002653"
},
{
"date": "2012-05-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-318"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2012-1814"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-318"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DeltaV Multiple Product Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "IVD",
"id": "c52838a8-2353-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-2636"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-318"
}
],
"trust": 0.6
}
}
VAR-201310-0174
Vulnerability from variot - Updated: 2025-04-11 22:53The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service. Emerson Process Management Emerson Process Control is a company that includes process control, electrical and telecommunications, industrial automation, heat transfer, HVAC, and appliances and tools. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. The ROC800 RTU kernel contains a port for connecting to the debug tool. An attacker can change memory, registers, process state, and full control of the device. Emerson ROC800 Remote Terminal Units are prone to a remote code-execution vulnerability. A remote attacker can leverage this issue to execute arbitrary code within the context of the affected device. Successful exploits will completely compromise the device. The following products are affected: ROC800 3.50 and prior DL8000 2.30 and prior ROC800L 1.20 and prior. The three products ROC800, ROC800L, and DL8000 use ROC800 RTUs
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201310-0174",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "2.30"
},
{
"model": "roc 800 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "dl 8000 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "roc 800l remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "1.20"
},
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "3.50"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "1.20 (roc800l rtu)"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "2.30 (dl8000 rtu)"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "3.50 (roc800 rtu)"
},
{
"model": "dl8000 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800l rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "electric co roc800l",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "1.20"
},
{
"model": "electric co dl8000",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "2.30"
},
{
"model": "electric co roc800",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "3.50"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "3.50"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "1.20"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "2.30"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "dl 8000 remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800 remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "1.20"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "2.30"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "3.50"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800l remote terminal unit",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
},
{
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:enea:ose",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:dl_8000_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800l_remote_terminal_unit",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dillon Beresford, Brian Meixell, Marc Ayala and Eric Forner of Cimation",
"sources": [
{
"db": "BID",
"id": "62664"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
}
],
"trust": 0.9
},
"cve": "CVE-2013-0692",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2013-0692",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-13377",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-60694",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-0692",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2013-0692",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2013-13377",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201309-519",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-60694",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "VULHUB",
"id": "VHN-60694"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
},
{
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service. Emerson Process Management Emerson Process Control is a company that includes process control, electrical and telecommunications, industrial automation, heat transfer, HVAC, and appliances and tools. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. The ROC800 RTU kernel contains a port for connecting to the debug tool. An attacker can change memory, registers, process state, and full control of the device. Emerson ROC800 Remote Terminal Units are prone to a remote code-execution vulnerability. \nA remote attacker can leverage this issue to execute arbitrary code within the context of the affected device. Successful exploits will completely compromise the device. \nThe following products are affected:\nROC800 3.50 and prior\nDL8000 2.30 and prior\nROC800L 1.20 and prior. The three products ROC800, ROC800L, and DL8000 use ROC800 RTUs",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-0692"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "BID",
"id": "62664"
},
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-60694"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-0692",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-13-259-01",
"trust": 3.1
},
{
"db": "BID",
"id": "62664",
"trust": 1.6
},
{
"db": "CNVD",
"id": "CNVD-2013-13377",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201309-519",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484",
"trust": 0.8
},
{
"db": "IVD",
"id": "9E2C8EDA-2352-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-60694",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "VULHUB",
"id": "VHN-60694"
},
{
"db": "BID",
"id": "62664"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
},
{
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"id": "VAR-201310-0174",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "VULHUB",
"id": "VHN-60694"
}
],
"trust": 1.9
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
}
]
},
"last_update_date": "2025-04-11T22:53:11.538000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.enea.com/"
},
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "Emerson ROC800 Remote Terminal Unit Remote Code Execution Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/39892"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-60694"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-13-259-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0692"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=2013-0692"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/62664"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "VULHUB",
"id": "VHN-60694"
},
{
"db": "BID",
"id": "62664"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
},
{
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"db": "VULHUB",
"id": "VHN-60694"
},
{
"db": "BID",
"id": "62664"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
},
{
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-09-29T00:00:00",
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"date": "2013-09-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"date": "2013-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-60694"
},
{
"date": "2013-09-26T00:00:00",
"db": "BID",
"id": "62664"
},
{
"date": "2013-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"date": "2013-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201309-519"
},
{
"date": "2013-10-03T11:04:37.383000",
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-09-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-13377"
},
{
"date": "2013-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-60694"
},
{
"date": "2014-12-24T00:55:00",
"db": "BID",
"id": "62664"
},
{
"date": "2013-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004484"
},
{
"date": "2013-10-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201309-519"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2013-0692"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Emerson ROC800 Remote Terminal Unit Remote Code Execution Vulnerability",
"sources": [
{
"db": "IVD",
"id": "9e2c8eda-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13377"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201309-519"
}
],
"trust": 0.6
}
}
VAR-201310-0173
Vulnerability from variot - Updated: 2025-04-11 22:53The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to upload files and consequently execute arbitrary code via unspecified vectors. Emerson Process Management Emerson Process Control is a company that includes process control, electrical and telecommunications, industrial automation, heat transfer, HVAC, and appliances and tools. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. The following products are affected: ROC800 3.50 and prior DL8000 2.30 and prior ROC800L 1.20 and prior. This product includes ROC800, ROC800L, DL8000, and has the function of executing multiple PLCs (digital operation operation electronics in industrial environments) on control equipment
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201310-0173",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "2.30"
},
{
"model": "roc 800 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "dl 8000 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "roc 800l remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "1.20"
},
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "3.50"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "1.20 (roc800l rtu)"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "2.30 (dl8000 rtu)"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "3.50 (roc800 rtu)"
},
{
"model": "dl8000 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800l rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "electric co roc800l",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "1.20"
},
{
"model": "electric co dl8000",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "2.30"
},
{
"model": "electric co roc800",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "3.50"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "3.50"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "1.20"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "2.30"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "dl 8000 remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800 remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "1.20"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "2.30"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "3.50"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800l remote terminal unit",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
},
{
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:enea:ose",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:dl_8000_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800l_remote_terminal_unit",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dillon Beresford, Brian Meixell, Marc Ayala and Eric Forner of Cimation",
"sources": [
{
"db": "BID",
"id": "62666"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
}
],
"trust": 0.9
},
"cve": "CVE-2013-0689",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2013-0689",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-13378",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "9e315456-2352-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-60691",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-0689",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2013-0689",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2013-13378",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201309-488",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-60691",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "VULHUB",
"id": "VHN-60691"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
},
{
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to upload files and consequently execute arbitrary code via unspecified vectors. Emerson Process Management Emerson Process Control is a company that includes process control, electrical and telecommunications, industrial automation, heat transfer, HVAC, and appliances and tools. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. \nThe following products are affected:\nROC800 3.50 and prior\nDL8000 2.30 and prior\nROC800L 1.20 and prior. This product includes ROC800, ROC800L, DL8000, and has the function of executing multiple PLCs (digital operation operation electronics in industrial environments) on control equipment",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-0689"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "BID",
"id": "62666"
},
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-60691"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-0689",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-13-259-01",
"trust": 3.1
},
{
"db": "BID",
"id": "62666",
"trust": 1.6
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2013-13378",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483",
"trust": 0.8
},
{
"db": "IVD",
"id": "9E315456-2352-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-60691",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "VULHUB",
"id": "VHN-60691"
},
{
"db": "BID",
"id": "62666"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
},
{
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"id": "VAR-201310-0173",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "VULHUB",
"id": "VHN-60691"
}
],
"trust": 1.9
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13378"
}
]
},
"last_update_date": "2025-04-11T22:53:11.498000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.enea.com/"
},
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "Multiple Emerson Process Management RTUs patch for arbitrary file upload vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/39891"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-94",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-60691"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-13-259-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0689"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0689"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/62666"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "VULHUB",
"id": "VHN-60691"
},
{
"db": "BID",
"id": "62666"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
},
{
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"db": "VULHUB",
"id": "VHN-60691"
},
{
"db": "BID",
"id": "62666"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
},
{
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-09-29T00:00:00",
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"date": "2013-09-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"date": "2013-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-60691"
},
{
"date": "2013-09-26T00:00:00",
"db": "BID",
"id": "62666"
},
{
"date": "2013-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"date": "2013-09-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201309-488"
},
{
"date": "2013-10-03T11:04:37.320000",
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-09-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-13378"
},
{
"date": "2013-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-60691"
},
{
"date": "2014-12-24T00:55:00",
"db": "BID",
"id": "62666"
},
{
"date": "2013-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004483"
},
{
"date": "2013-10-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201309-488"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2013-0689"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Emerson Process Management RTU File upload vulnerability in product software",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004483"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Code injection",
"sources": [
{
"db": "IVD",
"id": "9e315456-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-488"
}
],
"trust": 0.8
}
}
VAR-201310-0176
Vulnerability from variot - Updated: 2025-04-11 22:53The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier have hardcoded credentials in a ROM, which makes it easier for remote attackers to obtain shell access to the underlying OS by leveraging knowledge of the ROM contents from a product installation elsewhere. Emerson Process Management Emerson Process Control is a company that includes process control, electrical and telecommunications, industrial automation, heat transfer, HVAC, and appliances and tools. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. The ROC800 ROM contains a built-in account that allows remote attackers to access the operating system command shell and control the ROC800 device. Multiple Emerson Process Management RTUs including ROC800, DL8000, and ROC800L are prone to a security-bypass vulnerability caused by hard-coded credentials. An attacker can leverage this issue to gain access to the vulnerable device. The following versions are affected: ROC800 3.50 and prior DL8000 2.30 and prior ROC800L 1.20 and prior. The three products ROC800, ROC800L, and DL8000 use ROC800 RTUs
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201310-0176",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "2.30"
},
{
"model": "roc 800 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "dl 8000 remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "roc 800l remote terminal unit",
"scope": "eq",
"trust": 1.0,
"vendor": "emerson",
"version": null
},
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "1.20"
},
{
"model": "ose",
"scope": "lte",
"trust": 1.0,
"vendor": "enea",
"version": "3.50"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "1.20 (roc800l rtu)"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "2.30 (dl8000 rtu)"
},
{
"model": "ose",
"scope": "lte",
"trust": 0.8,
"vendor": "enia",
"version": "3.50 (roc800 rtu)"
},
{
"model": "dl8000 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800 rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "roc800l rtu",
"scope": null,
"trust": 0.8,
"vendor": "emerson",
"version": null
},
{
"model": "electric co roc800l",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "1.20"
},
{
"model": "electric co dl8000",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "2.30"
},
{
"model": "electric co roc800",
"scope": "eq",
"trust": 0.6,
"vendor": "emerson",
"version": "3.50"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "2.30"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "1.20"
},
{
"model": "ose",
"scope": "eq",
"trust": 0.6,
"vendor": "enea",
"version": "3.50"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "dl 8000 remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800 remote terminal unit",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "1.20"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "2.30"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ose",
"version": "3.50"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "roc 800l remote terminal unit",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
},
{
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:enea:ose",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:dl_8000_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800_remote_terminal_unit",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:emerson:roc_800l_remote_terminal_unit",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dillon Beresford, Brian Meixell, Marc Ayala and Eric Forner of Cimation",
"sources": [
{
"db": "BID",
"id": "62667"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
}
],
"trust": 0.9
},
"cve": "CVE-2013-0694",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2013-0694",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2013-13375",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-60696",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-0694",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2013-0694",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2013-13375",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201309-489",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-60696",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "VULHUB",
"id": "VHN-60696"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
},
{
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier have hardcoded credentials in a ROM, which makes it easier for remote attackers to obtain shell access to the underlying OS by leveraging knowledge of the ROM contents from a product installation elsewhere. Emerson Process Management Emerson Process Control is a company that includes process control, electrical and telecommunications, industrial automation, heat transfer, HVAC, and appliances and tools. The ROC800 RTU product is used to perform multiple PLC-like functions on the control device. The ROC800 ROM contains a built-in account that allows remote attackers to access the operating system command shell and control the ROC800 device. Multiple Emerson Process Management RTUs including ROC800, DL8000, and ROC800L are prone to a security-bypass vulnerability caused by hard-coded credentials. \nAn attacker can leverage this issue to gain access to the vulnerable device. \nThe following versions are affected:\nROC800 3.50 and prior\nDL8000 2.30 and prior\nROC800L 1.20 and prior. The three products ROC800, ROC800L, and DL8000 use ROC800 RTUs",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-0694"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "BID",
"id": "62667"
},
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-60696"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-0694",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-13-259-01",
"trust": 3.1
},
{
"db": "BID",
"id": "62667",
"trust": 1.6
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2013-13375",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486",
"trust": 0.8
},
{
"db": "IVD",
"id": "9E1B318A-2352-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-60696",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "VULHUB",
"id": "VHN-60696"
},
{
"db": "BID",
"id": "62667"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
},
{
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"id": "VAR-201310-0176",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "VULHUB",
"id": "VHN-60696"
}
],
"trust": 1.9
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13375"
}
]
},
"last_update_date": "2025-04-11T22:53:11.455000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.enea.com/"
},
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "http://www.emerson.co.jp/index.html"
},
{
"title": "Patches for multiple Emerson Process Management RTUs built-in account security bypass vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/39894"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-60696"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-13-259-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0694"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0694"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/62667"
},
{
"trust": 0.3,
"url": "http://www2.emersonprocess.com/en-us/brands/deltav/pages/index.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "VULHUB",
"id": "VHN-60696"
},
{
"db": "BID",
"id": "62667"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
},
{
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"db": "VULHUB",
"id": "VHN-60696"
},
{
"db": "BID",
"id": "62667"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
},
{
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-09-29T00:00:00",
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"date": "2013-09-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"date": "2013-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-60696"
},
{
"date": "2013-09-26T00:00:00",
"db": "BID",
"id": "62667"
},
{
"date": "2013-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"date": "2013-09-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201309-489"
},
{
"date": "2013-10-03T11:04:37.447000",
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-09-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-13375"
},
{
"date": "2013-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-60696"
},
{
"date": "2014-12-24T00:55:00",
"db": "BID",
"id": "62667"
},
{
"date": "2013-10-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004486"
},
{
"date": "2013-10-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201309-489"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2013-0694"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Emerson Process Management RTU Vulnerabilities in which shell access rights are obtained in product software",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004486"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Trust management",
"sources": [
{
"db": "IVD",
"id": "9e1b318a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201309-489"
}
],
"trust": 0.8
}
}