PT-2022-3157 · Emerson · Emerson Deltav Distributed Control System

Daniel Dos Santos + 1 · Published 2022-06-22 · Updated 2022-08-04 · CVE-2022-29962

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29

Description The issue is related to the misuse of passwords and the presence of hardcoded credentials in the FTP service of the Emerson DeltaV Distributed Control System, which may allow an attacker to gain unauthorized access to protected information. This affects S-series, P-series, and CIOC/EIOC nodes.

Recommendations For Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29, consider disabling the FTP service to minimize the risk of exploitation, especially if it is not necessary for production. Additionally, restrict access to the affected nodes, including S-series, P-series, and CIOC/EIOC, to prevent potential unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-03837

CVE-2022-29962

Affected Products

Emerson Deltav Distributed Control System

References · 8

• https://bdu.fstec.ru/vul/2022-03837 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29962 · Security Note
• https://forescout.com/resources/ot-icefall-report · Note
• https://t.me/cibsecurity/47045 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-181-03 · Note
• https://csirt.gob.cl/media/2022/06/9VSA22-00666-01-1.pdf · Note
• https://forescout.com/blog · Note