var-201901-0856
Vulnerability from variot
A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service. Emerson DeltaV DCS Contains vulnerabilities related to authorization, permissions, and access control.Service operation interruption (DoS) There is a possibility of being put into a state. The Emerson DeltaV Distributed Control System is an automated distributed control system from Emerson Electric. The system includes network security management, alarm management, batch control and change management. Emerson DeltaV is prone to an authentication-bypass vulnerability. DeltaV Distributed Control System 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior are vulnerable
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201901-0856", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "deltav", "scope": "eq", "trust": 1.3, "vendor": "emerson", "version": "13.3.1" }, { "model": "deltav", "scope": "eq", "trust": 1.3, "vendor": "emerson", "version": "11.3.2" }, { "model": "deltav", "scope": "eq", "trust": 1.3, "vendor": "emerson", "version": "11.3.1" }, { "model": "deltav", "scope": "eq", "trust": 1.3, "vendor": "emerson", "version": "12.3.1" }, { "model": "deltav", "scope": "gte", "trust": 1.0, "vendor": "emerson", "version": "r5.1" }, { "model": "deltav", "scope": "lte", "trust": 1.0, "vendor": "emerson", "version": "r6" }, { "model": "deltav", "scope": "eq", "trust": 1.0, "vendor": "emerson", "version": "14.3" }, { "model": "deltav distributed control system", "scope": "eq", "trust": 0.8, "vendor": "emerson", "version": "11.3.1" }, { "model": "deltav distributed control system", "scope": "eq", "trust": 0.8, "vendor": "emerson", "version": "11.3.2" }, { "model": "deltav distributed control system", "scope": "eq", "trust": 0.8, "vendor": "emerson", "version": "12.3.1" }, { "model": "deltav distributed control system", "scope": "eq", "trust": 0.8, "vendor": "emerson", "version": "13.3.1" }, { "model": "deltav distributed control system", "scope": "eq", "trust": 0.8, "vendor": "emerson", "version": "14.3" }, { "model": "deltav distributed control system", "scope": "eq", "trust": 0.8, "vendor": "emerson", "version": "r5.1" }, { "model": "deltav distributed control system", "scope": "lte", "trust": 0.8, "vendor": "emerson", "version": "r6" }, { "model": "electric deltav distributed control system", "scope": "eq", "trust": 0.6, "vendor": "emerson", "version": "11.3.1" }, { "model": "electric deltav distributed control system", "scope": "eq", "trust": 0.6, "vendor": "emerson", "version": "11.3.2" }, { "model": "electric deltav distributed control system", "scope": "eq", "trust": 0.6, "vendor": "emerson", "version": "12.3.1" }, { "model": "electric deltav distributed control system", "scope": "eq", "trust": 0.6, "vendor": "emerson", "version": "13.3.1" }, { "model": "electric deltav distributed control system", "scope": "eq", "trust": 0.6, "vendor": "emerson", "version": "14.3" }, { "model": "electric deltav distributed control system r5.1", "scope": null, "trust": 0.6, "vendor": "emerson", "version": null }, { "model": "electric deltav distributed control system \u003c=r6", "scope": null, "trust": 0.6, "vendor": "emerson", "version": null }, { "model": "deltav r6", "scope": null, "trust": 0.3, "vendor": "emerson", "version": null }, { "model": "deltav r5.1", "scope": null, "trust": 0.3, "vendor": "emerson", "version": null }, { "model": "deltav", "scope": "eq", "trust": 0.3, "vendor": "emerson", "version": "14.3.2" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "deltav distributed control system", "version": "11.3.1" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "deltav distributed control system", "version": "11.3.2" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "deltav distributed control system", "version": "12.3.1" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "deltav distributed control system", "version": "13.3.1" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "deltav distributed control system", "version": "14.3" }, { "model": "r5.1", "scope": null, "trust": 0.2, "vendor": "deltav distributed control system", "version": null }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "deltav distributed control system", "version": "*" } ], "sources": [ { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "db": "CNVD", "id": "CNVD-2019-01681" }, { "db": "BID", "id": "106522" }, { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "NVD", "id": "CVE-2018-19021" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:emerson:deltav_distributed_control_system", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-013887" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Alexander Nochvay of Kaspersky Lab", "sources": [ { "db": "BID", "id": "106522" }, { "db": "CNNVD", "id": "CNNVD-201901-433" } ], "trust": 0.9 }, "cve": "CVE-2018-19021", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "exploitabilityScore": 6.5, "id": "CVE-2018-19021", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "LOW", "trust": 1.8, "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "CNVD-2019-01681", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "IVD", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.2, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.9 [IVD]" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "ADJACENT", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "exploitabilityScore": 2.8, "id": "CVE-2018-19021", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Adjacent Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 6.5, "baseSeverity": "Medium", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2018-19021", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2018-19021", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2018-19021", "trust": 0.8, "value": "Medium" }, { "author": "CNVD", "id": "CNVD-2019-01681", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201901-433", "trust": 0.6, "value": "MEDIUM" }, { "author": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1", "trust": 0.2, "value": "MEDIUM" } ] } ], "sources": [ { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "db": "CNVD", "id": "CNVD-2019-01681" }, { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "CNNVD", "id": "CNNVD-201901-433" }, { "db": "NVD", "id": "CVE-2018-19021" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service. Emerson DeltaV DCS Contains vulnerabilities related to authorization, permissions, and access control.Service operation interruption (DoS) There is a possibility of being put into a state. The Emerson DeltaV Distributed Control System is an automated distributed control system from Emerson Electric. The system includes network security management, alarm management, batch control and change management. Emerson DeltaV is prone to an authentication-bypass vulnerability. \nDeltaV Distributed Control System 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior are vulnerable", "sources": [ { "db": "NVD", "id": "CVE-2018-19021" }, { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "CNVD", "id": "CNVD-2019-01681" }, { "db": "BID", "id": "106522" }, { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" } ], "trust": 2.61 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2018-19021", "trust": 3.5 }, { "db": "ICS CERT", "id": "ICSA-19-010-01", "trust": 2.7 }, { "db": "BID", "id": "106522", "trust": 2.5 }, { "db": "CNVD", "id": "CNVD-2019-01681", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201901-433", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2018-013887", "trust": 0.8 }, { "db": "IVD", "id": "7D84CD0F-463F-11E9-95FB-000C29342CB1", "trust": 0.2 } ], "sources": [ { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "db": "CNVD", "id": "CNVD-2019-01681" }, { "db": "BID", "id": "106522" }, { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "CNNVD", "id": "CNNVD-201901-433" }, { "db": "NVD", "id": "CVE-2018-19021" } ] }, "id": "VAR-201901-0856", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "db": "CNVD", "id": "CNVD-2019-01681" } ], "trust": 1.8 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS" ], "sub_category": null, "trust": 0.8 } ], "sources": [ { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "db": "CNVD", "id": "CNVD-2019-01681" } ] }, "last_update_date": "2024-11-23T22:48:30.705000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "DeltaV Distributed Control System", "trust": 0.8, "url": "https://www.emerson.com/en-us/automation/control-and-safety-systems/distributed-control-systems-dcs/deltav-distributed-control-system" }, { "title": "Emerson DeltaV Distributed Control System Authentication Vulnerability Vulnerability Patch", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/150173" }, { "title": "Emerson DeltaV Distributed Control System Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=88591" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2019-01681" }, { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "CNNVD", "id": "CNNVD-201901-433" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-307", "trust": 1.0 }, { "problemtype": "CWE-264", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "NVD", "id": "CVE-2018-19021" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.7, "url": "https://ics-cert.us-cert.gov/advisories/icsa-19-010-01" }, { "trust": 2.2, "url": "http://www.securityfocus.com/bid/106522" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-19021" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-19021" }, { "trust": 0.3, "url": "http://emerson.com" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2019-01681" }, { "db": "BID", "id": "106522" }, { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "CNNVD", "id": "CNNVD-201901-433" }, { "db": "NVD", "id": "CVE-2018-19021" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "db": "CNVD", "id": "CNVD-2019-01681" }, { "db": "BID", "id": "106522" }, { "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "db": "CNNVD", "id": "CNNVD-201901-433" }, { "db": "NVD", "id": "CVE-2018-19021" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-01-16T00:00:00", "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "date": "2019-01-16T00:00:00", "db": "CNVD", "id": "CNVD-2019-01681" }, { "date": "2019-01-10T00:00:00", "db": "BID", "id": "106522" }, { "date": "2019-03-05T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "date": "2019-01-14T00:00:00", "db": "CNNVD", "id": "CNNVD-201901-433" }, { "date": "2019-01-25T20:29:00.283000", "db": "NVD", "id": "CVE-2018-19021" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-01-16T00:00:00", "db": "CNVD", "id": "CNVD-2019-01681" }, { "date": "2019-01-10T00:00:00", "db": "BID", "id": "106522" }, { "date": "2019-03-05T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-013887" }, { "date": "2019-10-17T00:00:00", "db": "CNNVD", "id": "CNNVD-201901-433" }, { "date": "2024-11-21T03:57:10.977000", "db": "NVD", "id": "CVE-2018-19021" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote or local", "sources": [ { "db": "CNNVD", "id": "CNNVD-201901-433" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Emerson DeltaV Distributed Control System Authentication Bypass Vulnerability", "sources": [ { "db": "IVD", "id": "7d84cd0f-463f-11e9-95fb-000c29342cb1" }, { "db": "CNVD", "id": "CNVD-2019-01681" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control", "sources": [ { "db": "CNNVD", "id": "CNNVD-201901-433" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.