CVE-2014-2350: Emerson DeltaV Use of Hard-coded Credentials

Published May 22, 2014

Updated

Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.

Affected Software

4 affected components

Emerson DeltaV=10.3.1

Emerson DeltaV=11.3

Emerson DeltaV=11.3.1

Emerson DeltaV=12.3

Remediation

Information

Emerson has created a patch to mitigate these vulnerabilities. Emerson has distributed a notification (KBA NK-1400-0031) that provides details of the vulnerabilities, recommended mitigations, and instructions on obtaining and installing the patch. This document is available on Emerson’s support site to users who have support contracts with Emerson. If you do not have access to this site and need to apply the patch, please contact customer service at 1‑800‑833‑8314.

Event History

May 22, 2014

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2350?

CVE-2014-2350 is classified as a high severity vulnerability due to its potential for exploitation via hardcoded credentials.

How do I fix CVE-2014-2350?

To mitigate CVE-2014-2350, it is recommended to upgrade to versions of Emerson DeltaV that do not utilize hardcoded credentials for diagnostic services.

Which versions of Emerson DeltaV are affected by CVE-2014-2350?

CVE-2014-2350 affects Emerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3.

What can attackers do by exploiting CVE-2014-2350?

By exploiting CVE-2014-2350, attackers can bypass intended access restrictions and gain unauthorized remote access to the system.

Is there a workaround for CVE-2014-2350 if I cannot update?

A potential workaround for CVE-2014-2350 includes restricting network access to the affected service to trusted sources only.