PT-2022-3163 · Emerson · Emerson Deltav Distributed Control System
Daniel Dos Santos
+1
·
Published
2022-06-22
·
Updated
2023-01-24
·
CVE-2022-29965
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:N/C:C/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29
Description
The issue concerns the misuse of passwords in the Emerson DeltaV Distributed Control System. Access to privileged operations on the maintenance port TELNET interface on M-series and SIS nodes is controlled by utility passwords generated using a deterministic, insecure algorithm. This algorithm uses a single seed value with less than 16 bits of entropy, making it easy for an attacker to reconstruct the passwords and gain access to privileged maintenance operations. The vulnerability is related to the use of defective cryptographic algorithms, which can allow a remote attacker to access the system's interface.
Recommendations
For Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29, consider disabling the TELNET interface on the maintenance port as a temporary workaround to minimize the risk of exploitation. Restrict access to the maintenance port to prevent unauthorized access until a secure password generation algorithm is implemented.
Fix
Use of a Broken Cryptographic Algorithm
Inadequate Encryption Strength
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Emerson Deltav Distributed Control System