Emerson vulnerabilities
83 vulnerabilities
Known vulnerabilities in Emerson products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 103 products.
Products
50 of 103- Deltav15 vulnerabilities
- Wireless 1420 Gateway8 vulnerabilities
- Wireless 1410 Gateway7 vulnerabilities
- Deltav Workstation6 vulnerabilities
- Se4801T0X Redundant Wireless I\/O Card6 vulnerabilities
- Wireless 1410D Gateway6 vulnerabilities
- Wirelesshart Gateway6 vulnerabilities
- Deltav Distributed Control System Sq Controller5 vulnerabilities
- Deltav Distributed Control System Sx Controller5 vulnerabilities
- Deltav Proessentials Scientific Graph5 vulnerabilities
- Dl 8000 Remote Terminal Unit5 vulnerabilities
- Electric\'S Proficy5 vulnerabilities
- Openenterprise Scada Server5 vulnerabilities
- Roc 800 Remote Terminal Unit5 vulnerabilities
- Roc 800L Remote Terminal Unit5 vulnerabilities
- Se4002S1T2B6 High Side 40 Pin Mass I\/O Terminal Block5 vulnerabilities
- Se4003S2B4 16 Pin Mass I\/O Terminal Block5 vulnerabilities
- Se4003S2B524 Pin Mass I\/O Terminal Block5 vulnerabilities
- Se4017P0 H1 I\/O Interface Card And Terminl Block5 vulnerabilities
- Se4017P1 H1 I\/O Card With Integrated Power5 vulnerabilities
- Se4019P0 Simplex H1 4 Port Plus Fieldbus I\/O Interface With Terminalblock5 vulnerabilities
- Se4026 Virtual I\/O Module 25 vulnerabilities
- Se4027 Virtual I\/O Module 25 vulnerabilities
- Se4032S1T2B8 High Side 40 Pin Do Mass I\/O Terminal Block5 vulnerabilities
- Se4037P0 H1 I\/O Interface Card And Terminl Block5 vulnerabilities
- Se4037P1 Redundant H1 I\/O Card With Integrated Power And Terminal Block5 vulnerabilities
- Se4039P0 Redundant H1 4 Port Plus Fieldbus I\/O Interface With Terminalblock5 vulnerabilities
- Se4052S1T2B6 High Side 40 Pin Mass I\/O Terminal Block5 vulnerabilities
- Se4082S1T2B8 High Side 40 Pin Do Mass I\/O Terminal Block5 vulnerabilities
- Se4100 Simplex Ethernet I\/O Card \(Eioc\) Assembly5 vulnerabilities
- Se4101 Simplex Ethernet I\/O Card \(Eioc\) Assembly5 vulnerabilities
- Valvelink DTM5 vulnerabilities
- Valvelink PRM5 vulnerabilities
- Valvelink SNAP ON5 vulnerabilities
- Valvelink SOLO5 vulnerabilities
- Ve4103 Modbus Tcp Interface For Ethernet Connected I\/O \(Eioc\)5 vulnerabilities
- Ve4104 Ethernet\/Ip Control Tag Integration For Ethernet Connected I\/O \(Eioc\)5 vulnerabilities
- Ve4105 Ethernet\/Ip Interface For Ethernet Connected I\/O \(Eioc\)5 vulnerabilities
- Ve4106 Opc Ua Client For Ethernet Connected I\/O \(Eioc\)5 vulnerabilities
- Ve4107 Iec 61850 Mms Interface For Ethernet Connected I\/O \(Eioc\)5 vulnerabilities
- Gc1500Xa4 vulnerabilities
- Gc370Xa4 vulnerabilities
- Gc700Xa4 vulnerabilities
- Rosemount Gc1500Xa4 vulnerabilities
- Rosemount Gc370Xa4 vulnerabilities
- Rosemount Gc700Xa4 vulnerabilities
- Ams Device Manager3 vulnerabilities
- Deltav Distributed Control System3 vulnerabilities
- Openenterprise Scada Software3 vulnerabilities
- Controlwave Micro2 vulnerabilities
CVE-2018-19021emersondeltav+1
EPSS score0.72%
A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service.CVE-2018-11691emersonve6046_firmwareEPSS score2.30%
Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches’ management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson’s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool.CVE-2018-14791emersondeltav+1EPSS score0.36%
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on the affected products.CVE-2018-14793emersondeltav+1EPSS score1.03%
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allow arbitrary code execution.CVE-2018-14797emersondeltav+1EPSS score1.68%
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution.CVE-2018-14795emersondeltav+1EPSS score2.19%
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files.CVE-2018-14808emersonams_device_managerEPSS score0.90%
Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected products.CVE-2018-14804emersonams_device_managerEPSS score3.52%
Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution.CVE-2018-5452emersoncontrolwave_micro_firmwareEPSS score2.15%
A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v.4.01.280] firmware: CWM v.05.78.00 and prior. A stack-based buffer overflow vulnerability caused by sending crafted packets on Port 20547 could force the PLC to change its state into halt mode.CVE-2013-2810emersondl_8000_remote_terminal_unit_firmware+2EPSS score5.98%
Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary commands via a TCP replay attack.CVE-2013-0692emersondl_8000_remote_terminal_unit_firmware+3EPSS score4.86%
The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service.CVE-2013-0693emersondl_8000_remote_terminal_unit_firmware+3EPSS score3.26%
The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier performs network-beacon broadcasts, which allows remote attackers to obtain potentially sensitive information about device presence by listening for broadcast traffic.CVE-2013-0689emersondl_8000_remote_terminal_unit_firmware+3EPSS score5.04%
The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to upload files and consequently execute arbitrary code via unspecified vectors.CVE-2013-0694emersondl_8000_remote_terminal_unit_firmware+3EPSS score2.58%
The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier have hardcoded credentials in a ROM, which makes it easier for remote attackers to obtain shell access to the underlying OS by leveraging knowledge of the ROM contents from a product installation elsewhere.CVE-2013-6030emersonnetwork_power_avocent_mergepoint_unity_2016_firmwareEPSS score2.94%
Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.16473 allows remote attackers to read arbitrary files via unspecified vectors, as demonstrated by reading the /etc/passwd file.CVE-2021-26264emersondeltav_distributed_control_system+1EPSS score0.19%
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.CVE-2021-42536emersonwireless_1410_gateway_firmware+3EPSS score0.94%
The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.CVE-2021-42542emersonwireless_1410_gateway_firmware+3EPSS score1.48%
The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.CVE-2021-42538emersonwireless_1410_gateway_firmware+3EPSS score0.98%
The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input.CVE-2021-42539emersonwireless_1410_gateway_firmware+3EPSS score0.79%
The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change.