Emerson Electric vulnerabilities
7 vulnerabilities
Known vulnerabilities in Emerson Electric products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Proficy Machine Edition6 vulnerabilities
- Dl80001 vulnerabilities
- Roc8091 vulnerabilities
- Roc809L1 vulnerabilities
- Roc8271 vulnerabilities
HighCVE-2022-2788emerson electric · proficy machine edition +1 moreemerson electric proficy machine editionEmerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering station onto Windows in a way that executes the malicious code.EPSS0.24%HighCVE-2022-2793emerson electric · proficy machine edition +1 moreemerson electric proficy machine editionEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.EPSS0.14%MediumCVE-2022-2790emerson electric · proficy machine edition +1 moreemerson electric proficy machine editionEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic (PDT files) and data blocks data (BLD/BLK files).EPSS0.13%HighCVE-2022-2791emerson electric · proficy machine edition +1 moreemerson electric proficy machine editionEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.EPSS0.18%HighCVE-2022-2792emerson electric · proficy machine edition +1 moreemerson electric proficy machine editionEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists.EPSS0.42%MediumCVE-2022-2789emerson electric · proficy machine edition +1 moreemerson electric proficy machine editionEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logic that is different than the compiled logic.EPSS0.12%CriticalCVE-2023-1935emerson electric · dl8000 +3 moreCVE-2023-1935ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.EPSS0.68%