CVE-2022-29962: Medium severity emerson deltav distributed control system vulnerability
Published Jul 26, 2022
·Updated
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
Affected Software
53 affected components
Emerson DeltaV M-series
Emerson DeltaV S-series
Emerson DeltaV P-series
Emerson DeltaV SIS
Emerson DeltaV CIOC/EIOC/WIOC IO cards
Emerson Deltav Distributed Control System Sq Controller Firmware<=2022-04-29
Emerson Deltav Distributed Control System Sq Controller
Emerson Deltav Distributed Control System Sx Controller Firmware<=2022-04-29
Emerson Deltav Distributed Control System Sx Controller
Emerson Se4002s1t2b6 High Side 40-pin Mass I\/o Terminal Block Firmware<=2022-04-29
Emerson Se4002s1t2b6 High Side 40-pin Mass I\/o Terminal Block
Emerson Se4003s2b4 16-pin Mass I\/o Terminal Block Firmware<=2022-04-29
Emerson Se4003s2b4 16-pin Mass I\/o Terminal Block
Emerson Se4003s2b524-pin Mass I\/o Terminal Block Firmware<=2022-04-29
Emerson Se4003s2b524-pin Mass I\/o Terminal Block
Emerson Se4017p0 H1 I\/o Interface Card And Terminl Block Firmware<=2022-04-29
Emerson Se4017p0 H1 I\/o Interface Card And Terminl Block
Emerson Se4017p1 H1 I\/o Card With Integrated Power Firmware<=2022-04-29
Emerson Se4017p1 H1 I\/o Card With Integrated Power
Emerson Se4019p0 Simplex H1 4-port Plus Fieldbus I\/o Interface With Terminalblock Firmware<=2022-04-29
Emerson Se4019p0 Simplex H1 4-port Plus Fieldbus I\/o Interface With Terminalblock
Emerson Se4026 Virtual I\/o Module 2 Firmware<=2022-04-29
Emerson Se4026 Virtual I\/o Module 2
Emerson Se4027 Virtual I\/o Module 2 Firmware<=2022-04-29
Emerson Se4027 Virtual I\/o Module 2
Emerson Se4032s1t2b8 High Side 40-pin Do Mass I\/o Terminal Block Firmware<=2022-04-29
Emerson Se4032s1t2b8 High Side 40-pin Do Mass I\/o Terminal Block
Emerson Se4037p0 H1 I\/o Interface Card And Terminl Block Firmware<=2022-04-29
Emerson Se4037p0 H1 I\/o Interface Card And Terminl Block
Emerson Se4037p1 Redundant H1 I\/o Card With Integrated Power And Terminal Block Firmware<=2022-04-29
Emerson Se4037p1 Redundant H1 I\/o Card With Integrated Power And Terminal Block
Emerson Se4039p0 Redundant H1 4-port Plus Fieldbus I\/o Interface With Terminalblock Firmware<=2022-04-29
Emerson Se4039p0 Redundant H1 4-port Plus Fieldbus I\/o Interface With Terminalblock
Emerson Se4052s1t2b6 High Side 40-pin Mass I\/o Terminal Block Firmware<=2022-04-29
Emerson Se4052s1t2b6 High Side 40-pin Mass I\/o Terminal Block
Emerson Se4082s1t2b8 High Side 40-pin Do Mass I\/o Terminal Block Firmware<=2022-04-29
Emerson Se4082s1t2b8 High Side 40-pin Do Mass I\/o Terminal Block
Emerson Se4100 Simplex Ethernet I\/o Card \(eioc\) Assembly Firmware<=2022-04-29
Emerson Se4100 Simplex Ethernet I\/o Card \(eioc\) Assembly
Emerson Se4101 Simplex Ethernet I\/o Card \(eioc\) Assembly Firmware<=2022-04-29
Emerson Se4101 Simplex Ethernet I\/o Card \(eioc\) Assembly
Emerson Se4801t0x Redundant Wireless I\/o Card Firmware<=2022-04-29
Emerson Se4801t0x Redundant Wireless I\/o Card
Emerson Ve4103 Modbus Tcp Interface For Ethernet Connected I\/o \(eioc\) Firmware<=2022-04-29
Emerson Ve4103 Modbus Tcp Interface For Ethernet Connected I\/o \(eioc\)
Emerson Ve4104 Ethernet\/ip Control Tag Integration For Ethernet Connected I\/o \(eioc\) Firmware<=2022-04-29
Emerson Ve4104 Ethernet\/ip Control Tag Integration For Ethernet Connected I\/o \(eioc\)
Emerson Ve4105 Ethernet\/ip Interface For Ethernet Connected I\/o \(eioc\) Firmware<=2022-04-29
Emerson Ve4105 Ethernet\/ip Interface For Ethernet Connected I\/o \(eioc\)
Emerson Ve4106 Opc-ua Client For Ethernet Connected I\/o \(eioc\) Firmware<=2022-04-29
Emerson Ve4106 Opc-ua Client For Ethernet Connected I\/o \(eioc\)
Emerson Ve4107 Iec 61850 Mms Interface For Ethernet Connected I\/o \(eioc\) Firmware<=2022-04-29
Emerson Ve4107 Iec 61850 Mms Interface For Ethernet Connected I\/o \(eioc\)
Event History
Jul 26, 2022
CVE Published
via MITRE·09:14 PM
Data Sourced
via MITRE·09:14 PM
Description
Aug 3, 2024
Data Sourced
via ICS·06:43 AM
SeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-29962?
CVE-2022-29962 has been classified as a high-severity vulnerability as it involves hardcoded credentials in released firmware.
2
How do I fix CVE-2022-29962?
To mitigate CVE-2022-29962, it is recommended to update the affected Emerson DeltaV firmware to a version released after April 29, 2022.
3
What products are affected by CVE-2022-29962?
CVE-2022-29962 affects Emerson DeltaV S-series, P-series, and CIOC/EIOC nodes and firmware released up to April 29, 2022.
4
Can CVE-2022-29962 be exploited remotely?
Yes, CVE-2022-29962 can potentially be exploited remotely if the affected systems have FTP enabled with the default credentials.
5
What are the implications of CVE-2022-29962 for industrial control systems?
The implications include unauthorized access and control over industrial processes, which can result in operational disruption or safety incidents.