What’s Vulnerable › Vulnerabilities

CVE-2022-29962

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-26 · updated 2026-06-17
• Weakness: CWE-798

Description

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.

Affected products

• Emerson Deltav Distributed Control System Sq Controller Firmware: through 2022-04-29
• Emerson Deltav Distributed Control System Sx Controller Firmware: through 2022-04-29
• Emerson Se4002S1T2B6 High Side 40-Pin Mass I/O Terminal Block Firmware: through 2022-04-29
• Emerson Se4003S2B4 16-Pin Mass I/O Terminal Block Firmware: through 2022-04-29
• Emerson Se4003S2B524-Pin Mass I/O Terminal Block Firmware: through 2022-04-29
• Emerson Se4017P0 H1 I/O Interface Card And Terminl Block Firmware: through 2022-04-29
• Emerson Se4017P1 H1 I/O Card With Integrated Power Firmware: through 2022-04-29
• Emerson Se4019P0 Simplex H1 4-Port Plus Fieldbus I/O Interface With Terminalblock Firmware: through 2022-04-29
• Emerson Se4026 Virtual I/O Module 2 Firmware: through 2022-04-29
• Emerson Se4027 Virtual I/O Module 2 Firmware: through 2022-04-29
• Emerson Se4032S1T2B8 High Side 40-Pin Do Mass I/O Terminal Block Firmware: through 2022-04-29
• Emerson Se4037P0 H1 I/O Interface Card And Terminl Block Firmware: through 2022-04-29
• Emerson Se4037P1 Redundant H1 I/O Card With Integrated Power And Terminal Block Firmware: through 2022-04-29
• Emerson Se4039P0 Redundant H1 4-Port Plus Fieldbus I/O Interface With Terminalblock Firmware: through 2022-04-29
• Emerson Se4052S1T2B6 High Side 40-Pin Mass I/O Terminal Block Firmware: through 2022-04-29
• Emerson Se4082S1T2B8 High Side 40-Pin Do Mass I/O Terminal Block Firmware: through 2022-04-29
• Emerson Se4100 Simplex Ethernet I/O Card (Eioc) Assembly Firmware: through 2022-04-29
• Emerson Se4101 Simplex Ethernet I/O Card (Eioc) Assembly Firmware: through 2022-04-29
• Emerson Se4801T0X Redundant Wireless I/O Card Firmware: through 2022-04-29
• Emerson Ve4103 Modbus Tcp Interface For Ethernet Connected I/O (Eioc) Firmware: through 2022-04-29
• Emerson Ve4104 Ethernet/Ip Control Tag Integration For Ethernet Connected I/O (Eioc) Firmware: through 2022-04-29
• Emerson Ve4105 Ethernet/Ip Interface For Ethernet Connected I/O (Eioc) Firmware: through 2022-04-29
• Emerson Ve4106 Opc-Ua Client For Ethernet Connected I/O (Eioc) Firmware: through 2022-04-29
• Emerson Ve4107 Iec 61850 Mms Interface For Ethernet Connected I/O (Eioc) Firmware: through 2022-04-29

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
• https://www.forescout.com/blog/
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
• https://www.forescout.com/blog/

Get alerted when CVE-2022-29962 or the next vulnerability affects your stack