PT-2014-1222 · Emerson · Emerson Deltav

Kirill Nesterov

·

Published

2014-05-22

·

Updated

2025-10-31

·

CVE-2014-2350

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Emerson DeltaV versions 10.3.1 through 12.3
Description The issue is related to errors that occur when changing access control rules through the Telnet protocol, allowing an attacker to gain access to applications via Telnet to run commands or change settings. It also involves the use of hardcoded credentials for diagnostic services, which can be exploited by remote attackers to bypass access restrictions via a TCP session, such as a session using the telnet program.
Recommendations For Emerson DeltaV versions 10.3.1 through 12.3, consider disabling the use of hardcoded credentials for diagnostic services and restrict access to the Telnet protocol to minimize the risk of exploitation. As a temporary workaround, limit the use of the Telnet program for diagnostic purposes until a more secure method is implemented.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-255CWE-798

Related Identifiers

BDU:2014-00396
CVE-2014-2350

Affected Products

Emerson Deltav