CveMateVulnerability intelligence

Emerson vulnerabilities, page 2

83 vulnerabilities

Known vulnerabilities in Emerson products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 103 products.

CVE-2021-42540emersonwireless_1410_gateway_firmware+35y ago22-10-2021 13:23

The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.CVE-2021-29297emersonproficy_machine_edition5y ago30-07-2021 18:20

Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic from a Man-in-the-Middle (MITM) attack to the component "FrameworX.exe" in the module "MSVCR100.dll".CVE-2021-29298emersonproficy_machine_edition5y ago30-07-2021 18:20

Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic from a Man-in-the-Middle (MITM) attack to the component "FrameworX.exe"in the module "fxVPStatcTcp.dll".CVE-2021-38485emersonwireless_1410_gateway_firmware+35y ago22-10-2021 13:23

The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config files to replace any file on disk.CVE-2021-44463emersondeltav4y ago28-01-2022 19:09

Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.CVE-2021-45427emersonxweb300d_evo_firmware4y ago30-12-2021 11:10

Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal.CVE-2021-45420emersondixell_xweb-500_firmware4y ago14-02-2022 13:08

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.CVE-2021-45421emersondixell_xweb-500_firmware4y ago14-02-2022 13:08

Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced.CVE-2015-1008emersonams_device_manager11y ago26-05-2015 01:00

SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input.CVE-2016-9345emersondeltav9y ago13-02-2017 21:00

An issue was discovered in Emerson DeltaV Easy Security Management DeltaV V12.3, DeltaV V12.3.1, and DeltaV V13.3. Critical vulnerabilities may allow a local attacker to elevate privileges within the DeltaV control system.CVE-2016-9347emersonse4801t0x_redundant_wireless_i\/o_card_firmware+19y ago13-02-2017 21:00

An issue was discovered in Emerson SE4801T0X Redundant Wireless I/O Card V13.3, and SE4801T1X Simplex Wireless I/O Card V13.3. DeltaV Wireless I/O Cards (WIOC) running the firmware available in the DeltaV system, release v13.3, have the SSH (Secure Shell) functionality enabled unnecessarily.CVE-2016-8348emersonliebert_sitescan_web9y ago13-02-2017 21:00

An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.CVE-2025-52579emersonvalvelink dtm+31y ago10-07-2025 23:37

Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it.CVE-2025-48496emersonvalvelink dtm+31y ago10-07-2025 23:43

Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.CVE-2025-53471emersonvalvelink dtm+31y ago10-07-2025 23:45

Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.CVE-2025-46358emersonvalvelink dtm+31y ago10-07-2025 23:41

Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.CVE-2025-50109emersonvalvelink dtm+31y ago10-07-2025 23:39

Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.CVE-2020-16235emersonopen enterprise+14y ago19-05-2022 17:23

Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained.CVE-2020-19419emersonsmart_wireless_gateway_1420_firmware5y ago10-03-2021 17:17

Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator console without authentication.CVE-2020-19417emersonwireless_1420_gateway_firmware5y ago10-03-2021 17:15

Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative tasks by sending specially crafted HTTP requests to the application.