What’s Vulnerable › Vulnerabilities

CVE-2025-53471: Emerson ValveLink Products Improper Input Validation

• Severity: medium (CVSS 5.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-11 · updated 2026-06-17
• Weakness: CWE-20

Description

Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected products

• Emerson ValveLink DTM: before ValveLink 14.0 — fixed in ValveLink 14.0
• Emerson ValveLink PRM: before ValveLink 14.0 — fixed in ValveLink 14.0
• Emerson ValveLink SNAP-ON: before ValveLink 14.0 — fixed in ValveLink 14.0
• Emerson ValveLink SOLO: before ValveLink 14.0 — fixed in ValveLink 14.0

How to fix

Upgrade to a fixed version: Emerson ValveLink DTM ValveLink 14.0; Emerson ValveLink PRM ValveLink 14.0; Emerson ValveLink SNAP-ON ValveLink 14.0; Emerson ValveLink SOLO ValveLink 14.0. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-189-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01
• https://www.emerson.com/en-us/support/security-notifications
• https://www.emerson.com/en-us/support/software-downloads-drivers

Get alerted when CVE-2025-53471 or the next vulnerability affects your stack