CERT-In Vulnerability Note
CIVN-2021-0390
Multiple Vulnerabilities in Emerson DeltaV
Original Issue Date:December 31, 2021
Severity Rating: HIGH
Systems Affected
- DeltaV DCS Versions 13.3.1, 14.LTS, 14.FP1, 14.FP2, and R6
Overview
Multiple vulnerabilities have been reported in Emerson DeltaV which could allow an attacker to obtain local privilege escalation or cause denial-of-service condition on the targeted system.
Description
1. Missing Authentication vulnerability
(
CVE-2021-26264
)
This vulnerability exists in Emerson DeltaV due to missing authentication for a critical function. An attacker could send a specially crafted request and trick the application to initiate requests to arbitrary systems. Successful exploitation of this vulnerability could allow the attacker to cause a denial-of-service condition on the targeted system.
2. Authentication bypass vulnerability
(
CVE-2021-44463
)
This vulnerability exists in Emerson DeltaV due to uncontrolled search path element. An attacker could exploit this vulnerability by replacing dynamic link libraries with malicious ones.Successful exploitation of this vulnerability could allow an attacker to gain elevated privileges on the targeted system.
Solution
Upgrade to latest versions:
https://guardian.emerson.com (login required)
Vendor Information
https://guardian.emerson.com (login required)
References
https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04
CVE Name
CVE-2021-26264
CVE-2021-44463
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|