PT-2018-12731 · Emerson · Emerson Deltav Dcs

Alessandro Di Pinto + 4 · Published 2018-08-23 · Updated 2022-07-12 · CVE-2018-14797

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5

Description The issue allows a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution.

Recommendations For Emerson DeltaV DCS version 11.3.1, update to a version that includes a fix for this issue. For Emerson DeltaV DCS version 12.3.1, update to a version that includes a fix for this issue. For Emerson DeltaV DCS version 13.3.0, update to a version that includes a fix for this issue. For Emerson DeltaV DCS version 13.3.1, update to a version that includes a fix for this issue. For Emerson DeltaV DCS version R5, update to a version that includes a fix for this issue.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2018-14797

Affected Products

Emerson Deltav Dcs

References · 4

• https://osv.dev/vulnerability/CVE-2018-14797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14797 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01 · Note
• http://securityfocus.com/bid/105105 · Note