1087 matches found
Emerson DeltaV Distributed Control System Use of Hard-Coded Credentials (CVE-2022-29962, CVE-2022-29963, CVE-2022-29964, CVE-2022-29965, CVE-2022-30261, CVE-2022-30263, CVE-2022-30266)
The device may be vulnerable to flaws related to OT:ICEFALL. These vulnerabilities identify the insecure-by-design nature of OT devices and may not have a clear remediation path. As such, Nessus is unable to test specifically for these vulnerabilities but has identified the device to be one that...
PT-2022-3168 · Emerson · Emerson Controlwave 'Next Generation' Rtus
Name of the Vulnerable Software and Affected Versions: Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 Description: The issue is related to insufficient authentication of data, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denia...
PT-2022-3162 · Emerson · Emerson Openbsi
Name of the Vulnerable Software and Affected Versions: Emerson OpenBSI through 2022-04-29 Description: The issue is related to the use of weak cryptography in Emerson OpenBSI, an engineering environment for the ControlWave and Bristol Babcock line of RTUs. Specifically, DES with hardcoded...
CISA Releases Security Advisories Related to OT:ICEFALL (Insecure by Design) Report
CISA is aware that Forescout researchers have released OT:ICEFALL, a report on 56 vulnerabilities caused by insecure-by-design practices in operational technology across multiple vendors. The vulnerabilities are divided into four main categories: insecure engineering protocols, weak cryptography ...
Emerson Dixell Arbitrary File Write (CVE-2021-45420)
An arbitrary file write vulnerability exists in Emerson Dixell. Successful exploitation of this vulnerability could result in denial of service and potentially code execution on the affected system...
CVE-2020-16235
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained...
CVE-2020-16235
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained...
Code injection
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained...
CVE-2020-16235 Emerson OpenEnterprise - Inadequate Encryption Strength
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained...
CVE-2020-16235
CVE-2020-16235 affects Emerson OpenEnterprise (all versions through 3.3.5). The issue is inadequate encryption (CWE-326) that could allow credentials used by OpenEnterprise to access field devices and external systems to be obtained. Exploitation is described as local (not remote) with low attack...
CVE-2020-16235 Emerson OpenEnterprise - Inadequate Encryption Strength
Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be obtained...
Emerson XWEB 300D Directory Traversal (CVE-2021-45427)
A directory traversal vulnerability exists in Emerson XWEB 300D. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...
CVE-2020-10632
Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fail or behave in an unpredictable manner...
CVE-2020-10640
Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service...
CVE-2020-10640
Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service...
CVE-2020-10636
Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained...
CVE-2020-10636
Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained...
Remote code execution
Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service...