PT-2014-1221 · Emerson · Emerson Deltav

Dmitry Nagibin · Published 2014-05-22 · Updated 2025-10-31 · CVE-2014-2349

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Emerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3

Description The issue allows local users to modify or read configuration files by leveraging engineering-level privileges. It is related to errors that occur when processing a specially crafted configuration file, which can be exploited to elevate privileges and gain unauthorized access to confidential information.

Recommendations For Emerson DeltaV version 10.3.1, update to a version that fixes the issue with configuration file handling. For Emerson DeltaV version 11.3, update to a version that fixes the issue with configuration file handling. For Emerson DeltaV version 11.3.1, update to a version that fixes the issue with configuration file handling. For Emerson DeltaV version 12.3, update to a version that fixes the issue with configuration file handling. As a temporary workaround, consider restricting access to configuration files to minimize the risk of exploitation.

Fix

Improper Authorization

Using Hardcoded Credentials

Weakness Enumeration

CWE-264

CWE-285

CWE-798

Related Identifiers

BDU:2014-00395

CVE-2014-2349

Affected Products

Emerson Deltav

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-2349;%20http://secunia.com/advisories/58933/;%20http://securityfocus.com/bid/67594;%20http://ics-cert.us-cert.gov//advisories/ICSA-14-133-02;%20http://cnnvd.org.cn/vulnerability/show/cv_id/2014050452;%20http://securitylab.ru/lab/PT-2013-90 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2349 · Security Note
• https://bdu.fstec.ru/vul/2014-00395 · Security Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-133-02 · Note
• https://t.me/cveNotify/141215 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-14-133-02 · Note