Summary
Successful exploitation of these vulnerabilities could allow an attacker to achieve local privilege escalation or restart a controller, resulting in a denial-of-service condition.
Vulnerabilities 2
-
High 8.1
Emerson DeltaV Uncontrolled Search Path Element
Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.
-
Medium 6.1
Emerson DeltaV Missing Authentication for Critical Function
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.
Revision history
-
#1
ICSA-21-355-04 Emerson DeltaV
References
-
ICS Advisory ICSA-21-355-04 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-355-04
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams_0905.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B