Emerson
51 CVEs across 171 Emerson products. Browse Emerson vulnerabilities, severities, and proof-of-concept exploits.
Emerson products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-50930 | High | 8.4 | 2026-01-13 | Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code… |
CVE-2025-53471 | Medium | 5.1 | 2025-07-11 | Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to proce… |
CVE-2025-52579 | Critical | 9.4 | 2025-07-11 | Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain… |
CVE-2025-50109 | High | 7.7 | 2025-07-11 | Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere. |
CVE-2025-48496 | Medium | 5.1 | 2025-07-11 | Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of uninte… |
CVE-2025-46358 | High | 7.7 | 2025-07-11 | Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the produc… |
CVE-2024-1156 | High | 7.8 | 2024-02-20 | Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentia… |
CVE-2024-1155 | High | 7.8 | 2024-02-20 | Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalat… |
CVE-2023-51761 | High | 8.3 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabil… |
CVE-2023-49716 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer. |
CVE-2023-46687 | Critical | 9.8 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context f… |
CVE-2023-43609 | Medium | 6.9 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause… |
CVE-2023-1935 | Critical | 9.4 | 2023-08-02 | ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the devic… |
CVE-2022-30260 | High | 7.8 | 2022-12-26 | Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This a… |
CVE-2022-2791 | Medium | 5.9 | 2022-11-22 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any… |
CVE-2022-2793 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or au… |
CVE-2022-2792 | Medium | 6.6 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with… |
CVE-2022-2790 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not prope… |
CVE-2022-2789 | Medium | 4.7 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logi… |
CVE-2022-2788 | Low | 3.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, throu… |
CVE-2022-30262 | High | 7.8 | 2022-08-17 | The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates… |
CVE-2022-30264 | Critical | 9.8 | 2022-08-16 | The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for… |
CVE-2022-29959 | Medium | 5.5 | 2022-08-16 | Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This e… |
CVE-2022-29965 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the mainte… |
CVE-2022-29964 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root… |
CVE-2022-29963 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a roo… |
CVE-2022-29962 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often… |
CVE-2022-29960 | Medium | 5.5 | 2022-07-26 | Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hard… |
CVE-2022-29957 | High | 7.8 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety… |
CVE-2020-16235 | Low | 3.8 | 2022-05-19 | Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be ob… |
CVE-2020-10640 | Critical | 10.0 | 2022-02-24 | Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a… |
CVE-2020-10636 | Medium | 6.5 | 2022-02-24 | Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained. |
CVE-2020-10632 | High | 8.8 | 2022-02-24 | Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could ca… |
CVE-2021-45421 | High | 7.5 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all… |
CVE-2021-45420 | Critical | 9.8 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_u… |
CVE-2021-44463 | High | 8.1 | 2022-01-28 | Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and… |
CVE-2021-26264 | Medium | 6.1 | 2022-01-28 | A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition. |
CVE-2021-45427 | Critical | 9.8 | 2021-12-30 | Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files with… |
CVE-2021-42542 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure. |
CVE-2021-42540 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the set… |
CVE-2021-42539 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings c… |
CVE-2021-42538 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input. |
CVE-2021-42536 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables. |
CVE-2021-38485 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config files to replace any… |
CVE-2020-12030 | Critical | 10.0 | 2021-09-29 | There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the… |
CVE-2021-29298 | Medium | 5.3 | 2021-07-30 | Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via craft… |
CVE-2021-29297 | Medium | 5.3 | 2021-07-30 | Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic… |
CVE-2021-27467 | Medium | 6.1 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allows an attacker to rou… |
CVE-2021-27465 | Medium | 6.1 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications do not validate webpage input, which… |
CVE-2021-27463 | Medium | 5.3 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications utilize persistent cookies where the… |
CVE-2021-27461 | High | 7.5 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected webserver applications allow access to stored dat… |
CVE-2021-27459 | Critical | 9.8 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The webserver of the affected products allows unvalidated file… |
CVE-2021-27457 | High | 7.5 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for… |
CVE-2020-19419 | High | 7.5 | 2021-03-10 | Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator co… |
CVE-2020-19417 | High | 8.8 | 2021-03-10 | Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative tasks by sending special… |
CVE-2020-12525 | High | 7.3 | 2021-01-22 | M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its pro… |
CVE-2020-27254 | High | 7.5 | 2020-12-21 | Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authenticatio… |
CVE-2020-6971 | High | 7.8 | 2020-03-05 | In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to escalate privileges… |
CVE-2020-6970 | Critical | 9.8 | 2020-02-19 | A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all ver… |
CVE-2019-13524 | High | 7.5 | 2020-01-16 | GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow… |
CVE-2019-10967 | High | 8.8 | 2019-05-28 | In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a stack-based buffer overflow vulnerability in the embedded third-party FTP server involves improper ha… |
CVE-2019-10965 | High | 8.8 | 2019-05-28 | In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper han… |
CVE-2019-12167 | Medium | 6.1 | 2019-05-22 | httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter. |
CVE-2018-11691 | Critical | 9.8 | 2019-05-14 | Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches’ management pas… |
CVE-2018-19021 | Medium | 6.5 | 2019-01-25 | A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6… |
CVE-2018-14808 | Medium | 6.5 | 2018-10-01 | Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected products. |
CVE-2018-14804 | Critical | 9.8 | 2018-10-01 | Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution. |
CVE-2018-14797 | High | 7.8 | 2018-08-23 | Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and… |
CVE-2018-14791 | High | 7.8 | 2018-08-23 | Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on the affected produc… |
CVE-2018-14795 | High | 8.8 | 2018-08-21 | DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files. |
CVE-2018-14793 | High | 8.8 | 2018-08-21 | DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allow arbitrary code ex… |
CVE-2018-5452 | High | 7.5 | 2018-03-07 | A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v… |
CVE-2016-9347 | Medium | 5.0 | 2017-02-13 | An issue was discovered in Emerson SE4801T0X Redundant Wireless I/O Card V13.3, and SE4801T1X Simplex Wireless I/O Card V13.3. DeltaV Wireless I/O Cards (WIOC)… |
CVE-2016-9345 | Medium | 6.8 | 2017-02-13 | An issue was discovered in Emerson DeltaV Easy Security Management DeltaV V12.3, DeltaV V12.3.1, and DeltaV V13.3. Critical vulnerabilities may allow a local a… |
CVE-2016-8348 | Critical | 9.8 | 2017-02-13 | An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert Site… |
CVE-2015-1008 | | 2015-05-26 | SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input. | |
CVE-2013-2810 | | 2014-12-08 | Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier… | |
CVE-2014-2350 | | 2014-05-22 | Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restr… | |
CVE-2014-2349 | | 2014-05-22 | Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restr… | |
CVE-2013-6030 | | 2014-01-24 | Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.16473 allows remote att… | |
CVE-2013-0694 | | 2013-10-03 | The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and ear… | |
CVE-2013-0693 | | 2013-10-03 | The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU… | |
CVE-2013-0692 | | 2013-10-03 | The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU… | |
CVE-2013-0689 | | 2013-10-03 | The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with so… | |
CVE-2012-4703 | | 2013-03-11 | The Emerson DeltaV SE3006 through 11.3.1, DeltaV VE3005 through 10.3.1 and 11.x through 11.3.1, and DeltaV VE3006 through 10.3.1 and 11.x through 11.3.1 allow… | |
CVE-2012-3035 | | 2012-10-01 | Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service (daemon crash) via a long string to an uns… | |
CVE-2012-1818 | | 2012-06-08 | An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allo… | |
CVE-2012-1817 | | 2012-06-08 | Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assiste… | |
CVE-2012-1816 | | 2012-06-08 | PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attacker… | |
CVE-2012-1815 | | 2012-06-08 | SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows… | |
CVE-2012-1814 | | 2012-06-08 | Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5… |