PT-2021-7805 · Emerson · Emerson Rosemount X-Stream Gas Analyzer

Published 2021-05-18 · Updated 2021-05-28 · CVE-2021-27461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Emerson Rosemount X-STREAM Gas Analyzer (affected versions not specified)

Description A vulnerability has been found in the Emerson Rosemount X-STREAM Gas Analyzer, allowing access to stored data through specially crafted URLs. The issue is related to insufficient path name restrictions in the microprogram software of the gas analyzer, which can be exploited by a remote attacker to gain unauthorized access to protected information using a specially crafted malicious link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-02977

CVE-2021-27461

Affected Products

Emerson Rosemount X-Stream Gas Analyzer

References · 6

• https://bdu.fstec.ru/vul/2023-02977 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27461 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-21-138-01 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01 · Note
• https://t.me/cvenotify/15212 · Telegram Post
• https://t.me/cvenotify/14723 · Telegram Post