Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-29962 (GCVE-0-2022-29962)
Vulnerability from cvelistv5
- n/a
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03 | Third Party Advisory, US Government Resource | |
cve@mitre.org | https://www.forescout.com/blog/ | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03 | Third Party Advisory, US Government Resource | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.forescout.com/blog/ | Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T06:33:43.218Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.forescout.com/blog/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-07-26T21:14:40", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://www.forescout.com/blog/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-29962", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.forescout.com/blog/", "refsource": "MISC", "url": "https://www.forescout.com/blog/" }, { "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-29962", "datePublished": "2022-07-26T21:14:40", "dateReserved": "2022-04-29T00:00:00", "dateUpdated": "2024-08-03T06:33:43.218Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-29962\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-07-26T22:15:11.050\",\"lastModified\":\"2024-11-21T07:00:04.193\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.\"},{\"lang\":\"es\",\"value\":\"Los controladores del Sistema de Control Distribuido (DCS) de Emerson DeltaV y las tarjetas IO versiones hasta 29-04-2022, hacen un uso inapropiado de las contrase\u00f1as. El FTP presenta credenciales embebidas (pero a menudo puede estar deshabilitado en la producci\u00f3n). Esto afecta a los nodos de la serie S, la serie P y CIOC/EIOC. NOTA: esto es diferente de CVE-2014-2350.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:deltav_distributed_control_system_sq_controller_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"C0352AC6-4B32-4C94-A006-2B98C6C89882\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:deltav_distributed_control_system_sq_controller:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D565B21C-60BB-404B-BE80-62528DE1F15D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:deltav_distributed_control_system_sx_controller_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"C57F3262-3580-4376-BA56-35D31AD05FE4\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:deltav_distributed_control_system_sx_controller:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2249F041-9F01-4DA8-9A58-AF71B927BE04\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4002s1t2b6_high_side_40-pin_mass_i\\\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"C36E50DF-50EF-4585-9C9E-3CE98D7DE8F5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4002s1t2b6_high_side_40-pin_mass_i\\\\/o_terminal_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BF9A47C-1284-4CCA-80B4-E4A07A33D822\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4003s2b4_16-pin_mass_i\\\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"98C279FF-0A37-4D1B-8BA2-E26C2E57D8E6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4003s2b4_16-pin_mass_i\\\\/o_terminal_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8CEF8B0-8198-42D8-B0DF-E113014CAF99\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4003s2b524-pin_mass_i\\\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"3544369C-605D-4DB3-A833-51319868C5A9\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4003s2b524-pin_mass_i\\\\/o_terminal_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA97F935-4B3B-404C-9716-00DC1E823B39\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4017p0_h1_i\\\\/o_interface_card_and_terminl_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"EA113B46-5B27-43E6-AFC1-A664560FDA95\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4017p0_h1_i\\\\/o_interface_card_and_terminl_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96746FF1-06B3-44B2-8170-F644886E3B56\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4017p1_h1_i\\\\/o_card_with_integrated_power_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"D08A2F8D-009E-44B0-B8F6-5FFF1B8269EE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4017p1_h1_i\\\\/o_card_with_integrated_power:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60F172D4-3624-4718-89B3-3F3B33CEAE60\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4019p0_simplex_h1_4-port_plus_fieldbus_i\\\\/o_interface_with_terminalblock_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"38E2B7F7-C863-4DC0-8866-A2A5DEA865E0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4019p0_simplex_h1_4-port_plus_fieldbus_i\\\\/o_interface_with_terminalblock:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C2E234B-03F1-4C16-AFDA-1C76B3DEFF0E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4026_virtual_i\\\\/o_module_2_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"C158A562-C979-493D-8DCD-62D8464FE4A3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4026_virtual_i\\\\/o_module_2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A51BF73-33F0-44EF-A412-EF0CDF966222\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4027_virtual_i\\\\/o_module_2_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"2C7D7C1F-77DC-4323-ACAA-5D93C43ABE28\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4027_virtual_i\\\\/o_module_2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B041C40E-5510-43F7-836A-48C3643BDE35\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4032s1t2b8_high_side_40-pin_do_mass_i\\\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"71809713-E69E-441B-A61D-08F87A450BF8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4032s1t2b8_high_side_40-pin_do_mass_i\\\\/o_terminal_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28CF78B7-6921-42D2-AB02-E53D95245898\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4037p0_h1_i\\\\/o_interface_card_and_terminl_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"2FA77C5B-5521-4913-AE46-046AA709C6CB\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4037p0_h1_i\\\\/o_interface_card_and_terminl_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7324E231-7244-404A-BBCD-BE04495B4A31\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4037p1_redundant_h1_i\\\\/o_card_with_integrated_power_and_terminal_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"FF360367-3196-4FE3-AB51-284EFA6C8F3A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4037p1_redundant_h1_i\\\\/o_card_with_integrated_power_and_terminal_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"76C372C3-8BD0-4CC9-8753-DB8ED834BAF4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4039p0_redundant_h1_4-port_plus_fieldbus_i\\\\/o_interface_with_terminalblock_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"FE61CA37-BE15-400D-A9AF-268A2534EAA3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4039p0_redundant_h1_4-port_plus_fieldbus_i\\\\/o_interface_with_terminalblock:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25502581-C234-405E-B0A2-803FCCF9CB98\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4052s1t2b6_high_side_40-pin_mass_i\\\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"3369AED2-91CE-4EDD-9F6E-B50AB7326537\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4052s1t2b6_high_side_40-pin_mass_i\\\\/o_terminal_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3553747E-ACB7-4B0B-B72F-E309FB8C14CD\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4082s1t2b8_high_side_40-pin_do_mass_i\\\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"50FEFF3F-BF3F-45A8-A5A5-96210FD97B43\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4082s1t2b8_high_side_40-pin_do_mass_i\\\\/o_terminal_block:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBC1799C-5C6D-41DE-A05F-A0C376F4DF25\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4100_simplex_ethernet_i\\\\/o_card_\\\\(eioc\\\\)_assembly_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"5EB96C56-2399-4396-A3FD-D1A8146C5F13\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4100_simplex_ethernet_i\\\\/o_card_\\\\(eioc\\\\)_assembly:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A509A93B-9822-4029-88D4-1CA26AA26CA2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4101_simplex_ethernet_i\\\\/o_card_\\\\(eioc\\\\)_assembly_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"19A4EEA1-975A-4AFB-8F65-83FEADB81203\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4101_simplex_ethernet_i\\\\/o_card_\\\\(eioc\\\\)_assembly:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"119231C0-A3A7-4745-AA58-E3E0FFDF19AA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:se4801t0x_redundant_wireless_i\\\\/o_card_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"3AB79565-6EB6-4D0F-8008-FC0036811702\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:se4801t0x_redundant_wireless_i\\\\/o_card:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F515BD5-A516-4EF6-83BD-1D4FB13554A6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:ve4103_modbus_tcp_interface_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"B336486C-85E0-44DF-8D00-D8A44553CA68\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:ve4103_modbus_tcp_interface_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E124883C-AE12-4293-9755-E6E2D8FA14C4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:ve4104_ethernet\\\\/ip_control_tag_integration_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"CD7251E0-73AC-401E-A32D-B785175CA389\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:ve4104_ethernet\\\\/ip_control_tag_integration_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"74CAD82E-735A-4035-8B3E-48493F2571E0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:ve4105_ethernet\\\\/ip_interface_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"B9628C7C-A568-4BBC-A1E0-4346977726E5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:ve4105_ethernet\\\\/ip_interface_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7855329F-F2CB-43B9-9EF9-E09B420E7D9D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:ve4106_opc-ua_client_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"3D89F5E7-BFE6-4755-BF60-A00FAE06C027\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:ve4106_opc-ua_client_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BB62397-6E64-4D08-8A0F-00D007938D5B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:ve4107_iec_61850_mms_interface_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\)_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2022-04-29\",\"matchCriteriaId\":\"8E5E6739-53E7-46AB-B02E-212CF0E1AA26\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:ve4107_iec_61850_mms_interface_for_ethernet_connected_i\\\\/o_\\\\(eioc\\\\):-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59A77957-F875-4616-812F-F37A68622922\"}]}]}],\"references\":[{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.forescout.com/blog/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.forescout.com/blog/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
gsd-2022-29962
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-29962", "description": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.", "id": "GSD-2022-29962" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-29962" ], "details": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.", "id": "GSD-2022-29962", "modified": "2023-12-13T01:19:42.032937Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-29962", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.forescout.com/blog/", "refsource": "MISC", "url": "https://www.forescout.com/blog/" }, { "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:deltav_distributed_control_system_sq_controller_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:deltav_distributed_control_system_sq_controller:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:deltav_distributed_control_system_sx_controller_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:deltav_distributed_control_system_sx_controller:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4002s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4002s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4003s2b4_16-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4003s2b4_16-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4003s2b524-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4003s2b524-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4017p0_h1_i\\/o_interface_card_and_terminl_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4017p0_h1_i\\/o_interface_card_and_terminl_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4017p1_h1_i\\/o_card_with_integrated_power_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4017p1_h1_i\\/o_card_with_integrated_power:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4019p0_simplex_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4019p0_simplex_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4026_virtual_i\\/o_module_2_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4026_virtual_i\\/o_module_2:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4027_virtual_i\\/o_module_2_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4027_virtual_i\\/o_module_2:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4032s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4032s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4037p0_h1_i\\/o_interface_card_and_terminl_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4037p0_h1_i\\/o_interface_card_and_terminl_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4037p1_redundant_h1_i\\/o_card_with_integrated_power_and_terminal_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4037p1_redundant_h1_i\\/o_card_with_integrated_power_and_terminal_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4039p0_redundant_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4039p0_redundant_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4052s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4052s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4082s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4082s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4100_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4100_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4101_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4101_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:se4801t0x_redundant_wireless_i\\/o_card_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:se4801t0x_redundant_wireless_i\\/o_card:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:ve4103_modbus_tcp_interface_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:ve4103_modbus_tcp_interface_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:ve4104_ethernet\\/ip_control_tag_integration_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:ve4104_ethernet\\/ip_control_tag_integration_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:ve4105_ethernet\\/ip_interface_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:ve4105_ethernet\\/ip_interface_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:ve4106_opc-ua_client_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:ve4106_opc-ua_client_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:emerson:ve4107_iec_61850_mms_interface_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:emerson:ve4107_iec_61850_mms_interface_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-29962" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-798" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.forescout.com/blog/", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "https://www.forescout.com/blog/" }, { "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03", "refsource": "MISC", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 3.6 } }, "lastModifiedDate": "2022-08-04T15:56Z", "publishedDate": "2022-07-26T22:15Z" } } }
tid-311
Vulnerability from emb3d
Devices often include default credentials from the vendor. Default credentials can be changed but are often overlooked when devices are commissioned. If left unchanged, a threat actor may discover and use these credentials to gain unauthorized access to the device. Non-unique or predictable default credentials can lead to device compromise.
- CWE-1392: Use of Default Credentials (Base)
- CWE-1393: Use of Default Password (Base)
fkie_cve-2022-29962
Vulnerability from fkie_nvd
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03 | Third Party Advisory, US Government Resource | |
cve@mitre.org | https://www.forescout.com/blog/ | Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03 | Third Party Advisory, US Government Resource | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.forescout.com/blog/ | Third Party Advisory |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:deltav_distributed_control_system_sq_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0352AC6-4B32-4C94-A006-2B98C6C89882", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:deltav_distributed_control_system_sq_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "D565B21C-60BB-404B-BE80-62528DE1F15D", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:deltav_distributed_control_system_sx_controller_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57F3262-3580-4376-BA56-35D31AD05FE4", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:deltav_distributed_control_system_sx_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "2249F041-9F01-4DA8-9A58-AF71B927BE04", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4002s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C36E50DF-50EF-4585-9C9E-3CE98D7DE8F5", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4002s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "9BF9A47C-1284-4CCA-80B4-E4A07A33D822", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4003s2b4_16-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "98C279FF-0A37-4D1B-8BA2-E26C2E57D8E6", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4003s2b4_16-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "E8CEF8B0-8198-42D8-B0DF-E113014CAF99", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4003s2b524-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3544369C-605D-4DB3-A833-51319868C5A9", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4003s2b524-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "FA97F935-4B3B-404C-9716-00DC1E823B39", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4017p0_h1_i\\/o_interface_card_and_terminl_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA113B46-5B27-43E6-AFC1-A664560FDA95", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4017p0_h1_i\\/o_interface_card_and_terminl_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "96746FF1-06B3-44B2-8170-F644886E3B56", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4017p1_h1_i\\/o_card_with_integrated_power_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D08A2F8D-009E-44B0-B8F6-5FFF1B8269EE", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4017p1_h1_i\\/o_card_with_integrated_power:-:*:*:*:*:*:*:*", "matchCriteriaId": "60F172D4-3624-4718-89B3-3F3B33CEAE60", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4019p0_simplex_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "38E2B7F7-C863-4DC0-8866-A2A5DEA865E0", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4019p0_simplex_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock:-:*:*:*:*:*:*:*", "matchCriteriaId": "1C2E234B-03F1-4C16-AFDA-1C76B3DEFF0E", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4026_virtual_i\\/o_module_2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C158A562-C979-493D-8DCD-62D8464FE4A3", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4026_virtual_i\\/o_module_2:-:*:*:*:*:*:*:*", "matchCriteriaId": "4A51BF73-33F0-44EF-A412-EF0CDF966222", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4027_virtual_i\\/o_module_2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C7D7C1F-77DC-4323-ACAA-5D93C43ABE28", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4027_virtual_i\\/o_module_2:-:*:*:*:*:*:*:*", "matchCriteriaId": "B041C40E-5510-43F7-836A-48C3643BDE35", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4032s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "71809713-E69E-441B-A61D-08F87A450BF8", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4032s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "28CF78B7-6921-42D2-AB02-E53D95245898", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4037p0_h1_i\\/o_interface_card_and_terminl_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FA77C5B-5521-4913-AE46-046AA709C6CB", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4037p0_h1_i\\/o_interface_card_and_terminl_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "7324E231-7244-404A-BBCD-BE04495B4A31", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4037p1_redundant_h1_i\\/o_card_with_integrated_power_and_terminal_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF360367-3196-4FE3-AB51-284EFA6C8F3A", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4037p1_redundant_h1_i\\/o_card_with_integrated_power_and_terminal_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "76C372C3-8BD0-4CC9-8753-DB8ED834BAF4", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4039p0_redundant_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE61CA37-BE15-400D-A9AF-268A2534EAA3", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4039p0_redundant_h1_4-port_plus_fieldbus_i\\/o_interface_with_terminalblock:-:*:*:*:*:*:*:*", "matchCriteriaId": "25502581-C234-405E-B0A2-803FCCF9CB98", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4052s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3369AED2-91CE-4EDD-9F6E-B50AB7326537", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4052s1t2b6_high_side_40-pin_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "3553747E-ACB7-4B0B-B72F-E309FB8C14CD", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4082s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "50FEFF3F-BF3F-45A8-A5A5-96210FD97B43", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4082s1t2b8_high_side_40-pin_do_mass_i\\/o_terminal_block:-:*:*:*:*:*:*:*", "matchCriteriaId": "CBC1799C-5C6D-41DE-A05F-A0C376F4DF25", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4100_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5EB96C56-2399-4396-A3FD-D1A8146C5F13", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4100_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly:-:*:*:*:*:*:*:*", "matchCriteriaId": "A509A93B-9822-4029-88D4-1CA26AA26CA2", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4101_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "19A4EEA1-975A-4AFB-8F65-83FEADB81203", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4101_simplex_ethernet_i\\/o_card_\\(eioc\\)_assembly:-:*:*:*:*:*:*:*", "matchCriteriaId": "119231C0-A3A7-4745-AA58-E3E0FFDF19AA", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:se4801t0x_redundant_wireless_i\\/o_card_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3AB79565-6EB6-4D0F-8008-FC0036811702", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:se4801t0x_redundant_wireless_i\\/o_card:-:*:*:*:*:*:*:*", "matchCriteriaId": "1F515BD5-A516-4EF6-83BD-1D4FB13554A6", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:ve4103_modbus_tcp_interface_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B336486C-85E0-44DF-8D00-D8A44553CA68", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:ve4103_modbus_tcp_interface_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "E124883C-AE12-4293-9755-E6E2D8FA14C4", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:ve4104_ethernet\\/ip_control_tag_integration_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD7251E0-73AC-401E-A32D-B785175CA389", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:ve4104_ethernet\\/ip_control_tag_integration_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "74CAD82E-735A-4035-8B3E-48493F2571E0", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:ve4105_ethernet\\/ip_interface_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B9628C7C-A568-4BBC-A1E0-4346977726E5", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:ve4105_ethernet\\/ip_interface_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "7855329F-F2CB-43B9-9EF9-E09B420E7D9D", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:ve4106_opc-ua_client_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D89F5E7-BFE6-4755-BF60-A00FAE06C027", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:ve4106_opc-ua_client_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "9BB62397-6E64-4D08-8A0F-00D007938D5B", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:emerson:ve4107_iec_61850_mms_interface_for_ethernet_connected_i\\/o_\\(eioc\\)_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E5E6739-53E7-46AB-B02E-212CF0E1AA26", "versionEndIncluding": "2022-04-29", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:emerson:ve4107_iec_61850_mms_interface_for_ethernet_connected_i\\/o_\\(eioc\\):-:*:*:*:*:*:*:*", "matchCriteriaId": "59A77957-F875-4616-812F-F37A68622922", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350." }, { "lang": "es", "value": "Los controladores del Sistema de Control Distribuido (DCS) de Emerson DeltaV y las tarjetas IO versiones hasta 29-04-2022, hacen un uso inapropiado de las contrase\u00f1as. El FTP presenta credenciales embebidas (pero a menudo puede estar deshabilitado en la producci\u00f3n). Esto afecta a los nodos de la serie S, la serie P y CIOC/EIOC. NOTA: esto es diferente de CVE-2014-2350." } ], "id": "CVE-2022-29962", "lastModified": "2024-11-21T07:00:04.193", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2022-07-26T22:15:11.050", "references": [ { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "https://www.forescout.com/blog/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "https://www.forescout.com/blog/" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-798" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
icsa-22-181-03
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "names": [ "Daniel dos Santos", "Jos Wetzels" ], "organization": "Forescout Technologies", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities can result in a denial-of-service condition, manipulation of runtime communications, or compromise of a controller.", "title": "Risk evaluation" }, { "category": "other", "text": "Multiple Sectors", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "United States", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability these vulnerabilities. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities have a high attack complexity.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-22-181-03 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-181-03.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-181-03 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-181-03" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Emerson DeltaV Distributed Control System", "tracking": { "current_release_date": "2022-06-30T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-181-03", "initial_release_date": "2022-06-30T00:00:00.000000Z", "revision_history": [ { "date": "2022-06-30T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV CIOC/EIOC/WIOC IO cards: All versions", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "DeltaV CIOC/EIOC/WIOC IO cards" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV M-series: All versions", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "DeltaV M-series" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV P-series: All versions", "product_id": "CSAFPID-0003" } } ], "category": "product_name", "name": "DeltaV P-series" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV SIS: All versions", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "DeltaV SIS" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV S-series: All versions", "product_id": "CSAFPID-0005" } } ], "category": "product_name", "name": "DeltaV S-series" } ], "category": "vendor", "name": "Emerson" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29957", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "summary", "text": "Several protocols, including Firmware upgrade, Plug-and-Play, Hawk services, Management, SIS communications, and multi-cast have no authentication. This could allow an attacker who has reverse-engineered communications to invoke desired functionality or cause a denial-of-service condition.CVE-2022-29957 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29957" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29962", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable by using hard-coded credentials in the FTP service, which is disabled by default.CVE-2022-29962 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29962" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has mitigated CVE-2022-29962, CVE-2022-29963, and CVE-2022-29964 in all currently supported versions of DeltaV. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29963", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable to hard-coded credential use within the read-only Telnet service.CVE-2022-29963 has been assigned to this vulnerability. A CVSS v3 base score of 1.8 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29963" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has mitigated CVE-2022-29962, CVE-2022-29963, and CVE-2022-29964 in all currently supported versions of DeltaV. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 1.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29964", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable to hard-coded credential use within the SSH service, which is disabled by default.CVE-2022-29964 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29964" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has mitigated CVE-2022-29962, CVE-2022-29963, and CVE-2022-29964 in all currently supported versions of DeltaV. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-30260", "cwe": { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" }, "notes": [ { "category": "summary", "text": "Firmware images are not signed and rely on insecure checksums for regular integrity checks. This could allow an attacker to push malicious firmware images, execute code, or cause a denial-of-service condition.CVE-2022-30260 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29960" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29965", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "Access to privileged operations in the maintenance interface is controlled by a challenge-response authentication that uses a deterministic insecure algorithm.CVE-2022-29965 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29965" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has corrected CVE-2022-29965 in all currently supported versions of DeltaV. For additional mitigations and preventative measures, please see the Emerson Guardian Support Portal (login required).", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] } ] }
ICSA-22-181-03
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "names": [ "Daniel dos Santos", "Jos Wetzels" ], "organization": "Forescout Technologies", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities can result in a denial-of-service condition, manipulation of runtime communications, or compromise of a controller.", "title": "Risk evaluation" }, { "category": "other", "text": "Multiple Sectors", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "United States", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability these vulnerabilities. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities have a high attack complexity.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-22-181-03 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-181-03.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-181-03 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-181-03" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Emerson DeltaV Distributed Control System", "tracking": { "current_release_date": "2022-06-30T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-181-03", "initial_release_date": "2022-06-30T00:00:00.000000Z", "revision_history": [ { "date": "2022-06-30T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV CIOC/EIOC/WIOC IO cards: All versions", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "DeltaV CIOC/EIOC/WIOC IO cards" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV M-series: All versions", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "DeltaV M-series" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV P-series: All versions", "product_id": "CSAFPID-0003" } } ], "category": "product_name", "name": "DeltaV P-series" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV SIS: All versions", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "DeltaV SIS" }, { "branches": [ { "category": "product_version", "name": "vers:all/*", "product": { "name": "DeltaV S-series: All versions", "product_id": "CSAFPID-0005" } } ], "category": "product_name", "name": "DeltaV S-series" } ], "category": "vendor", "name": "Emerson" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29957", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "summary", "text": "Several protocols, including Firmware upgrade, Plug-and-Play, Hawk services, Management, SIS communications, and multi-cast have no authentication. This could allow an attacker who has reverse-engineered communications to invoke desired functionality or cause a denial-of-service condition.CVE-2022-29957 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29957" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29962", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable by using hard-coded credentials in the FTP service, which is disabled by default.CVE-2022-29962 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29962" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has mitigated CVE-2022-29962, CVE-2022-29963, and CVE-2022-29964 in all currently supported versions of DeltaV. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29963", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable to hard-coded credential use within the read-only Telnet service.CVE-2022-29963 has been assigned to this vulnerability. A CVSS v3 base score of 1.8 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29963" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has mitigated CVE-2022-29962, CVE-2022-29963, and CVE-2022-29964 in all currently supported versions of DeltaV. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 1.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29964", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable to hard-coded credential use within the SSH service, which is disabled by default.CVE-2022-29964 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29964" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has mitigated CVE-2022-29962, CVE-2022-29963, and CVE-2022-29964 in all currently supported versions of DeltaV. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-30260", "cwe": { "id": "CWE-345", "name": "Insufficient Verification of Data Authenticity" }, "notes": [ { "category": "summary", "text": "Firmware images are not signed and rely on insecure checksums for regular integrity checks. This could allow an attacker to push malicious firmware images, execute code, or cause a denial-of-service condition.CVE-2022-30260 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29960" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" } ], "remediations": [ { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] }, { "cve": "CVE-2022-29965", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "notes": [ { "category": "summary", "text": "Access to privileged operations in the maintenance interface is controlled by a challenge-response authentication that uses a deterministic insecure algorithm.CVE-2022-29965 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Vulnerability Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29965" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "Emerson has corrected CVE-2022-29965 in all currently supported versions of DeltaV. For additional mitigations and preventative measures, please see the Emerson Guardian Support Portal (login required).", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" }, { "category": "mitigation", "details": "Emerson corrected the Firmware image verification vulnerability in Version 14.3 and mitigated it in all other versions. Please see the Emerson Guardian Support Portal (login required) for more information.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ], "url": "https://guardian.emerson.com/Login/" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005" ] } ] } ] }
ghsa-79fv-frff-xcj5
Vulnerability from github
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
{ "affected": [], "aliases": [ "CVE-2022-29962" ], "database_specific": { "cwe_ids": [ "CWE-798" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2022-07-26T22:15:00Z", "severity": "MODERATE" }, "details": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.", "id": "GHSA-79fv-frff-xcj5", "modified": "2022-08-05T00:00:28Z", "published": "2022-07-27T00:00:32Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29962" }, { "type": "WEB", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" }, { "type": "WEB", "url": "https://www.forescout.com/blog" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ] }
var-202206-2263
Vulnerability from variot
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350. DeltaV Distributed Control System SQ controller firmware, DeltaV Distributed Control System SX controller firmware, SE4002S1T2B6 High Side 40-Pin Mass I/O Terminal Block Multiple Emerson products, including firmware, contain vulnerabilities related to the use of hard-coded credentials.Information may be obtained. Emerson DeltaV Distributed Control System
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202206-2263", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "se4017p1 h1 i\\/o card with integrated power", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "ve4105 ethernet\\/ip interface for ethernet connected i\\/o \\", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4037p1 redundant h1 i\\/o card with integrated power and terminal block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4082s1t2b8 high side 40-pin do mass i\\/o terminal block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "ve4103 modbus tcp interface for ethernet connected i\\/o \\", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "ve4107 iec 61850 mms interface for ethernet connected i\\/o \\", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4003s2b524-pin mass i\\/o terminal block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4027 virtual i\\/o module 2", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4019p0 simplex h1 4-port plus fieldbus i\\/o interface with terminalblock", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "ve4104 ethernet\\/ip control tag integration for ethernet connected i\\/o \\", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4037p0 h1 i\\/o interface card and terminl block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4017p0 h1 i\\/o interface card and terminl block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4026 virtual i\\/o module 2", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4032s1t2b8 high side 40-pin do mass i\\/o terminal block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4003s2b4 16-pin mass i\\/o terminal block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4002s1t2b6 high side 40-pin mass i\\/o terminal block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "ve4106 opc-ua client for ethernet connected i\\/o \\", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4039p0 redundant h1 4-port plus fieldbus i\\/o interface with terminalblock", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "deltav distributed control system sq controller", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4052s1t2b6 high side 40-pin mass i\\/o terminal block", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "deltav distributed control system sx controller", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4100 simplex ethernet i\\/o card \\ assembly", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4101 simplex ethernet i\\/o card \\ assembly", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4801t0x redundant wireless i\\/o card", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "2022-04-29" }, { "model": "se4101 simplex ethernet i/o card assembly", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4003s2b524-pin mass i/o terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4052s1t2b6 high side 40-pin mass i/o terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4037p1 redundant h1 i/o card with integrated power and terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4032s1t2b8 high side 40-pin do mass i/o terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4082s1t2b8 high side 40-pin do mass i/o terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4100 simplex ethernet i/o card assembly", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4801t0x redundant wireless i/o card", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4019p0 simplex h1 4-port plus fieldbus i/o interface with terminalblock", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4037p0 h1 i/o interface card and terminl block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4003s2b4 16-pin mass i/o terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4026 virtual i/o module 2", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4039p0 redundant h1 4-port plus fieldbus i/o interface with terminalblock", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4017p1 h1 i/o card with integrated power", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4017p0 h1 i/o card and terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "deltav distributed control system sq \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4027 virtual i/o module 2", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "ve4103 modbus tcp interface for ethernet connected i/o", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "se4002s1t2b6 high side 40-pin mass i/o terminal block", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null }, { "model": "deltav distributed control system sx \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9", "scope": null, "trust": 0.8, "vendor": "\u30a8\u30de\u30bd\u30f3", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "db": "NVD", "id": "CVE-2022-29962" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Daniel dos Santos and Jos Wetzels from Forescout Technologies reported these vulnerabilities to CISA.", "sources": [ { "db": "CNNVD", "id": "CNNVD-202206-2918" } ], "trust": 0.6 }, "cve": "CVE-2022-29962", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "id": "CVE-2022-29962", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "None", "baseScore": 5.5, "baseSeverity": "Medium", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2022-29962", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2022-29962", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2022-29962", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-202206-2918", "trust": 0.6, "value": "MEDIUM" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "db": "CNNVD", "id": "CNNVD-202206-2918" }, { "db": "NVD", "id": "CVE-2022-29962" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350. DeltaV Distributed Control System SQ controller firmware, DeltaV Distributed Control System SX controller firmware, SE4002S1T2B6 High Side 40-Pin Mass I/O Terminal Block Multiple Emerson products, including firmware, contain vulnerabilities related to the use of hard-coded credentials.Information may be obtained. Emerson DeltaV Distributed Control System", "sources": [ { "db": "NVD", "id": "CVE-2022-29962" }, { "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "db": "VULMON", "id": "CVE-2022-29962" } ], "trust": 1.71 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2022-29962", "trust": 3.3 }, { "db": "ICS CERT", "id": "ICSA-22-181-03", "trust": 2.5 }, { "db": "JVN", "id": "JVNVU92990931", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2022-018034", "trust": 0.8 }, { "db": "CS-HELP", "id": "SB2022071112", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202206-2918", "trust": 0.6 }, { "db": "VULMON", "id": "CVE-2022-29962", "trust": 0.1 } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-29962" }, { "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "db": "CNNVD", "id": "CNNVD-202206-2918" }, { "db": "NVD", "id": "CVE-2022-29962" } ] }, "id": "VAR-202206-2263", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.6666667 }, "last_update_date": "2024-08-14T13:53:12.514000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Emerson DeltaV Distributed Control System Repair measures for trust management problem vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=202540" } ], "sources": [ { "db": "CNNVD", "id": "CNNVD-202206-2918" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-798", "trust": 1.0 }, { "problemtype": "Use hard-coded credentials (CWE-798) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "db": "NVD", "id": "CVE-2022-29962" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03" }, { "trust": 2.4, "url": "https://www.forescout.com/blog/" }, { "trust": 0.8, "url": "https://jvn.jp/vu/jvnvu92990931/" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-29962" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2022071112" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2022-29962/" }, { "trust": 0.6, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-181-03" } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-29962" }, { "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "db": "CNNVD", "id": "CNNVD-202206-2918" }, { "db": "NVD", "id": "CVE-2022-29962" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULMON", "id": "CVE-2022-29962" }, { "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "db": "CNNVD", "id": "CNNVD-202206-2918" }, { "db": "NVD", "id": "CVE-2022-29962" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-10-18T00:00:00", "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "date": "2022-06-30T00:00:00", "db": "CNNVD", "id": "CNNVD-202206-2918" }, { "date": "2022-07-26T22:15:11.050000", "db": "NVD", "id": "CVE-2022-29962" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2023-10-18T07:23:00", "db": "JVNDB", "id": "JVNDB-2022-018034" }, { "date": "2022-08-05T00:00:00", "db": "CNNVD", "id": "CNNVD-202206-2918" }, { "date": "2022-08-04T15:56:16.620000", "db": "NVD", "id": "CVE-2022-29962" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "CNNVD", "id": "CNNVD-202206-2918" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Hardcoded Credentials Usage Vulnerability in Multiple Emerson Products", "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-018034" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "trust management problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-202206-2918" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.