CVSS: 5.5EPSS: 0%CPEs: 49EXPL: 0CVE-2022-29965
https://notcve.org/view.php?id=CVE-2022-29965
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03 https://www.forescout.com/blog • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2021-44463 – Emerson DeltaV Uncontrolled Search Path Element
https://notcve.org/view.php?id=CVE-2021-44463
Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started. Unas DLLs que faltan, si son reemplazadas por un insider, podrían permitir a un atacante lograr una escalada local de privilegios en DeltaV Distributed Control System Controllers and Workstations (Todas las versiones) cuando son iniciados algunos servicios DeltaV • https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04 • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-26264 – Emerson DeltaV Missing Authentication for Critical Function
https://notcve.org/view.php?id=CVE-2021-26264
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition. Un script especialmente diseñado podría hacer que DeltaV Distributed Control System Controllers (todas las versiones) se reinicien y causar una condición de denegación de servicio • https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-19021
https://notcve.org/view.php?id=CVE-2018-19021
A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service. Un script especialmente manipulado podría omitir la autenticación de un puerto de mantenimiento de Emerson DeltaV DCS, en versiones 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 y anteriores, lo que podría permitir a un atacante provocar una denegación de servicio (DoS). • http://www.securityfocus.com/bid/106522 https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-14797
https://notcve.org/view.php?id=CVE-2018-14797
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution. En Emerson DeltaV DCS en versiones 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 permite que se coloque un archivo DLL especialmente manipulado en la ruta de búsqueda y que se cargue como un DLL interno válido, lo que podría provocar la ejecución arbitraria de código. • http://www.securityfocus.com/bid/105105 https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01 • CWE-427: Uncontrolled Search Path Element •