Sign-up

ID

VAR-201405-0281


CVE

CVE-2014-2350


TITLE

Emerson DeltaV Vulnerable to access restrictions

Trust: 0.8

sources: JVNDB: JVNDB-2014-002623

DESCRIPTION

Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program. Emerson DeltaV is a digital automation system from Emerson, USA. The system provides I/O on-demand configuration, embedded intelligent control and alarm panel functions. Emerson DeltaV has a security bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable application. Emerson DeltaV versions 10.3.1, 11.3, 11.3.1, and 12.3 are vulnerable. DeltaV Versions 10.3.1, 11.3, 11.3.1, and 12.3 Can be related to Emerson AMS Device Management version, Emerson AMS Wireless SNAP-ON also. CVE-2014-2349 - World writable system folder CVE-2014-2350 - Hardcoded credentials Please find fixes in KBA NK-1400-0031. Kudos: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov and Timur Yunusov http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html

Trust: 3.06

sources: NVD: CVE-2014-2350 // JVNDB: JVNDB-2014-002623 // CNVD: CNVD-2014-03278 // BID: 67596 // IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d // IVD: f73024e8-2351-11e6-abef-000c29c66e3d // IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1 // PACKETSTORM: 126810

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.2

sources: IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d // IVD: f73024e8-2351-11e6-abef-000c29c66e3d // IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1 // CNVD: CNVD-2014-03278

AFFECTED PRODUCTS

vendor:emersonmodel:deltavscope:eqversion:10.3.1

Trust: 3.3

vendor:emersonmodel:deltavscope:eqversion:11.3

Trust: 3.3

vendor:emersonmodel:deltavscope:eqversion:11.3.1

Trust: 3.3

vendor:emersonmodel:deltavscope:eqversion:12.3

Trust: 3.3

vendor:deltavmodel: - scope:eqversion:10.3.1

Trust: 0.6

vendor:deltavmodel: - scope:eqversion:11.3

Trust: 0.6

vendor:deltavmodel: - scope:eqversion:11.3.1

Trust: 0.6

vendor:deltavmodel: - scope:eqversion:12.3

Trust: 0.6

sources: IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d // IVD: f73024e8-2351-11e6-abef-000c29c66e3d // IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1 // CNVD: CNVD-2014-03278 // BID: 67596 // JVNDB: JVNDB-2014-002623 // CNNVD: CNNVD-201405-453 // NVD: CVE-2014-2350

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-2350
value: HIGH

Trust: 1.0

NVD: CVE-2014-2350
value: HIGH

Trust: 0.8

CNVD: CNVD-2014-03278
value: LOW

Trust: 0.6

CNNVD: CNNVD-201405-453
value: HIGH

Trust: 0.6

IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

IVD: f73024e8-2351-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2014-2350
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-03278
severity: LOW
baseScore: 2.4
vectorString: AV:L/AC:H/AU:S/C:N/I:P/A:P
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 1.5
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d
severity: LOW
baseScore: 2.4
vectorString: AV:L/AC:H/AU:S/C:N/I:P/A:P
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 1.5
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: f73024e8-2351-11e6-abef-000c29c66e3d
severity: LOW
baseScore: 2.4
vectorString: AV:L/AC:H/AU:S/C:N/I:P/A:P
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 1.5
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1
severity: LOW
baseScore: 2.4
vectorString: AV:L/AC:H/AU:S/C:N/I:P/A:P
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 1.5
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d // IVD: f73024e8-2351-11e6-abef-000c29c66e3d // IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1 // CNVD: CNVD-2014-03278 // JVNDB: JVNDB-2014-002623 // CNNVD: CNNVD-201405-453 // NVD: CVE-2014-2350

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.8

sources: JVNDB: JVNDB-2014-002623 // NVD: CVE-2014-2350

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201405-453

TYPE

Trust management

Trust: 1.2

sources: IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d // IVD: f73024e8-2351-11e6-abef-000c29c66e3d // IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1 // CNNVD: CNNVD-201405-453

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-002623

PATCH
title:分散型制御システム（DCS） DeltaVシステムurl:http://www.emerson.co.jp/div/epm/product5_1.html
Trust: 0.8
title:Emerson DeltaV hard-coded certificate security bypass vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/45903
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-03278 // 
            
            
            
            JVNDB: JVNDB-2014-002623

EXTERNAL IDS
db:NVDid:CVE-2014-2350
Trust: 4.0
db:ICS CERTid:ICSA-14-133-02
Trust: 2.7
db:CNVDid:CNVD-2014-03278
Trust: 1.2
db:CNNVDid:CNNVD-201405-453
Trust: 1.2
db:BIDid:67596
Trust: 0.9
db:JVNDBid:JVNDB-2014-002623
Trust: 0.8
db:OSVDBid:107279
Trust: 0.6
db:IVDid:E84687A4-1ED5-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:F73024E8-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:7D70A8D1-463F-11E9-929A-000C29342CB1
Trust: 0.2
db:PACKETSTORMid:126810
Trust: 0.1
sources:
            
            
            IVD: e84687a4-1ed5-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: f73024e8-2351-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: 7d70a8d1-463f-11e9-929a-000c29342cb1 // 
            
            
            
            CNVD: CNVD-2014-03278 // 
            
            
            
            BID: 67596 // 
            
            
            
            JVNDB: JVNDB-2014-002623 // 
            
            
            
            PACKETSTORM: 126810 // 
            
            
            
            CNNVD: CNNVD-201405-453 // 
            
            
            
            NVD: CVE-2014-2350

REFERENCES
url:http://ics-cert.us-cert.gov/advisories/icsa-14-133-02
Trust: 2.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2350
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2350
Trust: 0.8
url:http://osvdb.com/show/osvdb/107279
Trust: 0.6
url:http://www2.emersonprocess.com/en-us/brands/edservices/automationsystems/deltav/pages/deltavtraining.aspx
Trust: 0.3
url:http://ics-cert.us-cert.gov/advisories/icsa-14-133-02#footnotee_tgc3i2k
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-2350
Trust: 0.1
url:http://www.scadastrangelove.blogspot.com/2014/05/emerson-deltav-vulnerabilitiesfixes.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-2349
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03278 // 
            
            
            
            BID: 67596 // 
            
            
            
            JVNDB: JVNDB-2014-002623 // 
            
            
            
            PACKETSTORM: 126810 // 
            
            
            
            CNNVD: CNNVD-201405-453 // 
            
            
            
            NVD: CVE-2014-2350

CREDITS
Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov, and Timur Yunusov.
Trust: 0.3
sources:
            
            
            BID: 67596

SOURCES
db:IVDid:e84687a4-1ed5-11e6-abef-000c29c66e3d
db:IVDid:f73024e8-2351-11e6-abef-000c29c66e3d
db:IVDid:7d70a8d1-463f-11e9-929a-000c29342cb1
db:CNVDid:CNVD-2014-03278
db:BIDid:67596
db:JVNDBid:JVNDB-2014-002623
db:PACKETSTORMid:126810
db:CNNVDid:CNNVD-201405-453
db:NVDid:CVE-2014-2350

LAST UPDATE DATE
2025-04-13T23:22:38.568000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-03278date:2014-05-27T00:00:00
db:BIDid:67596date:2014-05-22T00:00:00
db:JVNDBid:JVNDB-2014-002623date:2014-05-26T00:00:00
db:CNNVDid:CNNVD-201405-453date:2014-05-26T00:00:00
db:NVDid:CVE-2014-2350date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:IVDid:e84687a4-1ed5-11e6-abef-000c29c66e3ddate:2014-05-27T00:00:00
db:IVDid:f73024e8-2351-11e6-abef-000c29c66e3ddate:2014-05-27T00:00:00
db:IVDid:7d70a8d1-463f-11e9-929a-000c29342cb1date:2014-05-27T00:00:00
db:CNVDid:CNVD-2014-03278date:2014-05-27T00:00:00
db:BIDid:67596date:2014-05-22T00:00:00
db:JVNDBid:JVNDB-2014-002623date:2014-05-26T00:00:00
db:PACKETSTORMid:126810date:2014-05-27T04:44:44
db:CNNVDid:CNNVD-201405-453date:2014-05-26T00:00:00
db:NVDid:CVE-2014-2350date:2014-05-22T20:55:06.440