Sign-up

ID

VAR-201405-0280


CVE

CVE-2014-2349


TITLE

Emerson DeltaV '\DeltaV' Directory Authorization Security Bypass Vulnerability

Trust: 0.9

sources: IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1 // IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d // IVD: f732f984-2351-11e6-abef-000c29c66e3d // BID: 67594

DESCRIPTION

Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 allows local users to modify or read configuration files by leveraging engineering-level privileges. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. Emerson DeltaV has a security bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Emerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3 are vulnerable. DeltaV Versions 10.3.1, 11.3, 11.3.1, and 12.3 Can be related to Emerson AMS Device Management version, Emerson AMS Wireless SNAP-ON also. CVE-2014-2349 - World writable system folder CVE-2014-2350 - Hardcoded credentials Please find fixes in KBA NK-1400-0031. Kudos: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov and Timur Yunusov http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html

Trust: 3.06

sources: NVD: CVE-2014-2349 // JVNDB: JVNDB-2014-002622 // CNVD: CNVD-2014-03277 // BID: 67594 // IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1 // IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d // IVD: f732f984-2351-11e6-abef-000c29c66e3d // PACKETSTORM: 126810

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.2

sources: IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1 // IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d // IVD: f732f984-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-03277

AFFECTED PRODUCTS

vendor:emersonmodel:deltavscope:eqversion:10.3.1

Trust: 3.3

vendor:emersonmodel:deltavscope:eqversion:11.3

Trust: 3.3

vendor:emersonmodel:deltavscope:eqversion:11.3.1

Trust: 3.3

vendor:emersonmodel:deltavscope:eqversion:12.3

Trust: 3.3

vendor:deltavmodel: - scope:eqversion:10.3.1

Trust: 0.6

vendor:deltavmodel: - scope:eqversion:11.3

Trust: 0.6

vendor:deltavmodel: - scope:eqversion:11.3.1

Trust: 0.6

vendor:deltavmodel: - scope:eqversion:12.3

Trust: 0.6

sources: IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1 // IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d // IVD: f732f984-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-03277 // BID: 67594 // JVNDB: JVNDB-2014-002622 // CNNVD: CNNVD-201405-452 // NVD: CVE-2014-2349

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-2349
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-2349
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-03277
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201405-452
value: MEDIUM

Trust: 0.6

IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1
value: MEDIUM

Trust: 0.2

IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: f732f984-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2014-2349
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-03277
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:L/AU:S/C:N/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.1
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:L/AU:S/C:N/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.1
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:L/AU:S/C:N/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.1
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: f732f984-2351-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:L/AU:S/C:N/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.1
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1 // IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d // IVD: f732f984-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-03277 // JVNDB: JVNDB-2014-002622 // CNNVD: CNNVD-201405-452 // NVD: CVE-2014-2349

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.8

sources: JVNDB: JVNDB-2014-002622 // NVD: CVE-2014-2349

THREAT TYPE

local

Trust: 0.9

sources: BID: 67594 // CNNVD: CNNVD-201405-452

TYPE

Permission permission and access control

Trust: 0.6

sources: IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1 // IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d // IVD: f732f984-2351-11e6-abef-000c29c66e3d

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-002622

PATCH
title:分散型制御システム（DCS） DeltaVシステムurl:http://www.emerson.co.jp/div/epm/product5_1.html
Trust: 0.8
title:Emerson DeltaV '\\DeltaV' directory authorizes security to bypass vulnerability patchesurl:https://www.cnvd.org.cn/patchInfo/show/45902
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-03277 // 
            
            
            
            JVNDB: JVNDB-2014-002622

EXTERNAL IDS
db:NVDid:CVE-2014-2349
Trust: 4.0
db:ICS CERTid:ICSA-14-133-02
Trust: 3.3
db:CNVDid:CNVD-2014-03277
Trust: 1.2
db:CNNVDid:CNNVD-201405-452
Trust: 1.2
db:BIDid:67594
Trust: 0.9
db:JVNDBid:JVNDB-2014-002622
Trust: 0.8
db:OSVDBid:107278
Trust: 0.6
db:IVDid:7D70CFDE-463F-11E9-83B6-000C29342CB1
Trust: 0.2
db:IVDid:EA6FA934-1ED5-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:F732F984-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:126810
Trust: 0.1
sources:
            
            
            IVD: 7d70cfde-463f-11e9-83b6-000c29342cb1 // 
            
            
            
            IVD: ea6fa934-1ed5-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: f732f984-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2014-03277 // 
            
            
            
            BID: 67594 // 
            
            
            
            JVNDB: JVNDB-2014-002622 // 
            
            
            
            PACKETSTORM: 126810 // 
            
            
            
            CNNVD: CNNVD-201405-452 // 
            
            
            
            NVD: CVE-2014-2349

REFERENCES
url:http://ics-cert.us-cert.gov/advisories/icsa-14-133-02
Trust: 3.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2349
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2349
Trust: 0.8
url:http://osvdb.com/show/osvdb/107278
Trust: 0.6
url:http://www2.emersonprocess.com/en-us/brands/edservices/automationsystems/deltav/pages/deltavtraining.aspx
Trust: 0.3
url:http://ics-cert.us-cert.gov/advisories/icsa-14-133-02#footnotee_tgc3i2k
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-2350
Trust: 0.1
url:http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-2349
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03277 // 
            
            
            
            BID: 67594 // 
            
            
            
            JVNDB: JVNDB-2014-002622 // 
            
            
            
            PACKETSTORM: 126810 // 
            
            
            
            CNNVD: CNNVD-201405-452 // 
            
            
            
            NVD: CVE-2014-2349

CREDITS
Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov, and Timur Yunusov.
Trust: 0.3
sources:
            
            
            BID: 67594

SOURCES
db:IVDid:7d70cfde-463f-11e9-83b6-000c29342cb1
db:IVDid:ea6fa934-1ed5-11e6-abef-000c29c66e3d
db:IVDid:f732f984-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2014-03277
db:BIDid:67594
db:JVNDBid:JVNDB-2014-002622
db:PACKETSTORMid:126810
db:CNNVDid:CNNVD-201405-452
db:NVDid:CVE-2014-2349

LAST UPDATE DATE
2025-04-13T23:22:38.522000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-03277date:2014-05-27T00:00:00
db:BIDid:67594date:2014-05-22T00:00:00
db:JVNDBid:JVNDB-2014-002622date:2014-05-26T00:00:00
db:CNNVDid:CNNVD-201405-452date:2014-05-26T00:00:00
db:NVDid:CVE-2014-2349date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:IVDid:7d70cfde-463f-11e9-83b6-000c29342cb1date:2014-05-27T00:00:00
db:IVDid:ea6fa934-1ed5-11e6-abef-000c29c66e3ddate:2014-05-27T00:00:00
db:IVDid:f732f984-2351-11e6-abef-000c29c66e3ddate:2014-05-27T00:00:00
db:CNVDid:CNVD-2014-03277date:2014-05-27T00:00:00
db:BIDid:67594date:2014-05-22T00:00:00
db:JVNDBid:JVNDB-2014-002622date:2014-05-26T00:00:00
db:PACKETSTORMid:126810date:2014-05-27T04:44:44
db:CNNVDid:CNNVD-201405-452date:2014-05-26T00:00:00
db:NVDid:CVE-2014-2349date:2014-05-22T20:55:06.377