medium5.5
CVE-2022-29962
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.
Impact
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Emerson | Deltav Distributed Control System Sq Controller Firmware | through 2022-04-29 |
| Emerson | Deltav Distributed Control System Sx Controller Firmware | through 2022-04-29 |
| Emerson | Se4002s1t2b6 High Side 40-Pin Mass I\/O Terminal Block Firmware | through 2022-04-29 |
| Emerson | Se4003s2b4 16-Pin Mass I\/O Terminal Block Firmware | through 2022-04-29 |
| Emerson | Se4003s2b524-Pin Mass I\/O Terminal Block Firmware | through 2022-04-29 |
| Emerson | Se4017p0 H1 I\/O Interface Card And Terminl Block Firmware | through 2022-04-29 |
| Emerson | Se4017p1 H1 I\/O Card With Integrated Power Firmware | through 2022-04-29 |
| Emerson | Se4019p0 Simplex H1 4-Port Plus Fieldbus I\/O Interface With Terminalblock Firmware | through 2022-04-29 |
| Emerson | Se4026 Virtual I\/O Module 2 Firmware | through 2022-04-29 |
| Emerson | Se4027 Virtual I\/O Module 2 Firmware | through 2022-04-29 |
| Emerson | Se4032s1t2b8 High Side 40-Pin Do Mass I\/O Terminal Block Firmware | through 2022-04-29 |
| Emerson | Se4037p0 H1 I\/O Interface Card And Terminl Block Firmware | through 2022-04-29 |