CVE-2022-29964

Published: Jul 26, 2022Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350.

Affected (24)

Products: Emerson: Deltav Distributed Control System Sq Controller Firmware, Deltav Distributed Control System Sx Controller Firmware, Se4002s1t2b6 High Side 40 Pin Mass I/o Terminal Block Firmware, Se4003s2b4 16 Pin Mass I/o Terminal Block Firmware, Se4003s2b524 Pin Mass I/o Terminal Block Firmware, Se4017p0 H1 I/o Interface Card And Terminl Block Firmware, Se4017p1 H1 I/o Card With Integrated Power Firmware, Se4019p0 Simplex H1 4 Port Plus Fieldbus I/o Interface With Terminalblock Firmware, Se4026 Virtual I/o Module 2 Firmware, Se4027 Virtual I/o Module 2 Firmware, Se4032s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block Firmware, Se4037p0 H1 I/o Interface Card And Terminl Block Firmware, Se4037p1 Redundant H1 I/o Card With Integrated Power And Terminal Block Firmware, Se4039p0 Redundant H1 4 Port Plus Fieldbus I/o Interface With Terminalblock Firmware, Se4052s1t2b6 High Side 40 Pin Mass I/o Terminal Block Firmware, Se4082s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block Firmware, Se4100 Simplex Ethernet I/o Card (eioc) Assembly Firmware, Se4101 Simplex Ethernet I/o Card (eioc) Assembly Firmware, Se4801t0x Redundant Wireless I/o Card Firmware, Ve4103 Modbus Tcp Interface For Ethernet Connected I/o (eioc) Firmware, Ve4104 Ethernet/ip Control Tag Integration For Ethernet Connected I/o (eioc) Firmware, Ve4105 Ethernet/ip Interface For Ethernet Connected I/o (eioc) Firmware, Ve4106 Opc Ua Client For Ethernet Connected I/o (eioc) Firmware, Ve4107 Iec 61850 Mms Interface For Ethernet Connected I/o (eioc) Firmware

Emerson

24 products

Deltav Distributed Control System Sq Controller Firmware

Deltav Distributed Control System Sx Controller Firmware

Se4002s1t2b6 High Side 40 Pin Mass I/o Terminal Block Firmware

Se4003s2b4 16 Pin Mass I/o Terminal Block Firmware

Se4003s2b524 Pin Mass I/o Terminal Block Firmware

Se4017p0 H1 I/o Interface Card And Terminl Block Firmware

Se4017p1 H1 I/o Card With Integrated Power Firmware

Se4019p0 Simplex H1 4 Port Plus Fieldbus I/o Interface With Terminalblock Firmware

Se4026 Virtual I/o Module 2 Firmware

Se4027 Virtual I/o Module 2 Firmware

Se4032s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block Firmware

Se4037p0 H1 I/o Interface Card And Terminl Block Firmware

Se4037p1 Redundant H1 I/o Card With Integrated Power And Terminal Block Firmware

Se4039p0 Redundant H1 4 Port Plus Fieldbus I/o Interface With Terminalblock Firmware

Se4052s1t2b6 High Side 40 Pin Mass I/o Terminal Block Firmware

Se4082s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block Firmware

Se4100 Simplex Ethernet I/o Card (eioc) Assembly Firmware

Se4101 Simplex Ethernet I/o Card (eioc) Assembly Firmware

Se4801t0x Redundant Wireless I/o Card Firmware

Ve4103 Modbus Tcp Interface For Ethernet Connected I/o (eioc) Firmware

Ve4104 Ethernet/ip Control Tag Integration For Ethernet Connected I/o (eioc) Firmware

Ve4105 Ethernet/ip Interface For Ethernet Connected I/o (eioc) Firmware

Ve4106 Opc Ua Client For Ethernet Connected I/o (eioc) Firmware

Ve4107 Iec 61850 Mms Interface For Ethernet Connected I/o (eioc) Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Deltav Distributed Control System Sq Controller Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Deltav Distributed Control System Sq Controller	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Deltav Distributed Control System Sx Controller Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Deltav Distributed Control System Sx Controller	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4002s1t2b6 High Side 40 Pin Mass I/o Terminal Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4002s1t2b6 High Side 40 Pin Mass I/o Terminal Block	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4003s2b4 16 Pin Mass I/o Terminal Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4003s2b4 16 Pin Mass I/o Terminal Block	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4003s2b524 Pin Mass I/o Terminal Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4003s2b524 Pin Mass I/o Terminal Block	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4017p0 H1 I/o Interface Card And Terminl Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4017p0 H1 I/o Interface Card And Terminl Block	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4017p1 H1 I/o Card With Integrated Power Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4017p1 H1 I/o Card With Integrated Power	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4019p0 Simplex H1 4 Port Plus Fieldbus I/o Interface With Terminalblock Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4019p0 Simplex H1 4 Port Plus Fieldbus I/o Interface With Terminalblock	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4026 Virtual I/o Module 2 Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4026 Virtual I/o Module 2	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4027 Virtual I/o Module 2 Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4027 Virtual I/o Module 2	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4032s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4032s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4037p0 H1 I/o Interface Card And Terminl Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4037p0 H1 I/o Interface Card And Terminl Block	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4037p1 Redundant H1 I/o Card With Integrated Power And Terminal Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4037p1 Redundant H1 I/o Card With Integrated Power And Terminal Block	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4039p0 Redundant H1 4 Port Plus Fieldbus I/o Interface With Terminalblock Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4039p0 Redundant H1 4 Port Plus Fieldbus I/o Interface With Terminalblock	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4052s1t2b6 High Side 40 Pin Mass I/o Terminal Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4052s1t2b6 High Side 40 Pin Mass I/o Terminal Block	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4082s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4082s1t2b8 High Side 40 Pin Do Mass I/o Terminal Block	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4100 Simplex Ethernet I/o Card (eioc) Assembly Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4100 Simplex Ethernet I/o Card (eioc) Assembly	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4101 Simplex Ethernet I/o Card (eioc) Assembly Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4101 Simplex Ethernet I/o Card (eioc) Assembly	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Se4801t0x Redundant Wireless I/o Card Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Se4801t0x Redundant Wireless I/o Card	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Ve4103 Modbus Tcp Interface For Ethernet Connected I/o (eioc) Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Ve4103 Modbus Tcp Interface For Ethernet Connected I/o (eioc)	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Ve4104 Ethernet/ip Control Tag Integration For Ethernet Connected I/o (eioc) Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Ve4104 Ethernet/ip Control Tag Integration For Ethernet Connected I/o (eioc)	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Ve4105 Ethernet/ip Interface For Ethernet Connected I/o (eioc) Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Ve4105 Ethernet/ip Interface For Ethernet Connected I/o (eioc)	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Ve4106 Opc Ua Client For Ethernet Connected I/o (eioc) Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Ve4106 Opc Ua Client For Ethernet Connected I/o (eioc)	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Emerson Ve4107 Iec 61850 Mms Interface For Ethernet Connected I/o (eioc) Firmware	Up to 2022-04-29

Running on/with	Platform Versions
Emerson Ve4107 Iec 61850 Mms Interface For Ethernet Connected I/o (eioc)	All versions

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (4)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: cve@mitre.org

Third Party Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.