CVE-2018-14797

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Emerson	DeltaV DCS	v11.3.1, v12.3.1, v13.3.0, v13.3.1, R5

References

http://www.securityfocus.com/bid/105105Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/105105Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-228-01Third Party Advisory, US Government Resource

Timeline

Published: Aug 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-147985.3Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The pro CVE-2018-147993.7In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize dat CVE-2018-14805.3IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cook CVE-2018-148007.8Delta Electronics ISPSoft version 3.0.5 and prior allow an attacker, by opening a crafted file, to cause the application to read past the bo CVE-2018-148016.2In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser passwor CVE-2018-148029.8Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The pro CVE-2018-148035.3Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vulnerability that could CVE-2018-148049.8Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution.CVE-2018-148059.8ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key val CVE-2018-148069.8Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.CVE-2018-148079.8A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow re CVE-2018-148086.5Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected product