Medium severity · published Jul 26, 2022
CVE-2022-29962
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Deltav Distributed Control System SQ Controller Firmware · Emerson
through 2022-04-29 · source: NVD
DD
Deltav Distributed Control System SX Controller Firmware · Emerson
through 2022-04-29 · source: NVD
SH
Se4002s1t2b6 High Side 40-pin Mass I/o Terminal Block Firmware · Emerson
through 2022-04-29 · source: NVD
S1
Se4003s2b4 16-pin Mass I/o Terminal Block Firmware · Emerson
through 2022-04-29 · source: NVD
SM
Se4003s2b524-pin Mass I/o Terminal Block Firmware · Emerson
through 2022-04-29 · source: NVD
SH
Se4017p0 H1 I/o Interface Card And Terminl Block Firmware · Emerson
through 2022-04-29 · source: NVD
SH
Se4017p1 H1 I/o Card With Integrated Power Firmware · Emerson
through 2022-04-29 · source: NVD
SS
Se4019p0 Simplex H1 4-port Plus Fieldbus I/o Interface With Terminalblock Firmware · Emerson
through 2022-04-29 · source: NVD
SV
Se4026 Virtual I/o Module 2 Firmware · Emerson
through 2022-04-29 · source: NVD
SV
Se4027 Virtual I/o Module 2 Firmware · Emerson
through 2022-04-29 · source: NVD
SH
Se4032s1t2b8 High Side 40-pin DO Mass I/o Terminal Block Firmware · Emerson
through 2022-04-29 · source: NVD
SH
Se4037p0 H1 I/o Interface Card And Terminl Block Firmware · Emerson
through 2022-04-29 · source: NVD
Affected product
DD
Deltav Distributed Control System SQ Controller Firmware
Emerson
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29962
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29962
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
Third Party Advisory
https://www.forescout.com/blog/
More from Deltav Distributed Control System SQ Controller Firmware
7.8
CVE-2022-30260
Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature)
5.5
CVE-2022-29965
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords
5.5
CVE-2022-29964
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords
5.5
CVE-2022-29963
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords