CVE-2014-2349

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-285 CWE-264

Affected software

Vendor	Product	Versions
Emerson	DeltaV	10.3.1; 11.3; 11.3.1; 12.3

References

https://www.cisa.gov/news-events/ics-advisories/icsa-14-133-02
http://ics-cert.us-cert.gov/advisories/ICSA-14-133-02Third Party Advisory, US Government Resource

Timeline

Published: May 22, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-23507.5Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass in CVE-2014-23517.5SQL injection vulnerability in the LiveData service in CSWorks before 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands v CVE-2014-23526.4The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable a CVE-2014-23534.3Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via u CVE-2014-23545.0Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cle CVE-2014-23556.9The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via CVE-2014-23565.0Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to CVE-2014-23577.1The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attack CVE-2014-23586.8Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fox-IT Fox DataDiode a CVE-2014-23595.9OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by read CVE-2014-23607.5OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report CVE-2014-23617.2OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site s