CVE-2022-29965
Description
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emerson deltav_distributed_control_system | v ≤ 2022-04-29 | — |
| emerson deltav_distributed_control_system_sq_controller_firmware | v ≤ 2022-04-29 | — |
| emerson deltav_distributed_control_system_sx_controller_firmware | v ≤ 2022-04-29 | — |
| emerson se4002s1t2b6_high_side_40-pin_mass_i\/o_terminal_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4003s2b4_16-pin_mass_i\/o_terminal_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4003s2b524-pin_mass_i\/o_terminal_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4017p0_h1_i\/o_interface_card_and_terminl_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4017p1_h1_i\/o_card_with_integrated_power_firmware | v ≤ 2022-04-29 | — |
| emerson se4019p0_simplex_h1_4-port_plus_fieldbus_i\/o_interface_with_terminalblock_firmware | v ≤ 2022-04-29 | — |
| emerson se4026_virtual_i\/o_module_2_firmware | v ≤ 2022-04-29 | — |
| emerson se4027_virtual_i\/o_module_2_firmware | v ≤ 2022-04-29 | — |
| emerson se4032s1t2b8_high_side_40-pin_do_mass_i\/o_terminal_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4037p0_h1_i\/o_interface_card_and_terminl_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4037p1_redundant_h1_i\/o_card_with_integrated_power_and_terminal_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4039p0_redundant_h1_4-port_plus_fieldbus_i\/o_interface_with_terminalblock_firmware | v ≤ 2022-04-29 | — |
| emerson se4052s1t2b6_high_side_40-pin_mass_i\/o_terminal_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4082s1t2b8_high_side_40-pin_do_mass_i\/o_terminal_block_firmware | v ≤ 2022-04-29 | — |
| emerson se4100_simplex_ethernet_i\/o_card_\(eioc\)_assembly_firmware | v ≤ 2022-04-29 | — |
| emerson se4101_simplex_ethernet_i\/o_card_\(eioc\)_assembly_firmware | v ≤ 2022-04-29 | — |
| emerson se4801t0x_redundant_wireless_i\/o_card_firmware | v ≤ 2022-04-29 | — |
| emerson ve4103_modbus_tcp_interface_for_ethernet_connected_i\/o_\(eioc\)_firmware | v ≤ 2022-04-29 | — |
| emerson ve4104_ethernet\/ip_control_tag_integration_for_ethernet_connected_i\/o_\(eioc\)_firmware | v ≤ 2022-04-29 | — |
| emerson ve4105_ethernet\/ip_interface_for_ethernet_connected_i\/o_\(eioc\)_firmware | v ≤ 2022-04-29 | — |
| emerson ve4106_opc-ua_client_for_ethernet_connected_i\/o_\(eioc\)_firmware | v ≤ 2022-04-29 | — |
| emerson ve4107_iec_61850_mms_interface_for_ethernet_connected_i\/o_\(eioc\)_firmware | v ≤ 2022-04-29 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.