CVE-2022-29964

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Third Party Advisory, US Government Resource
https://www.forescout.com/blog/Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Third Party Advisory, US Government Resource
https://www.forescout.com/blog/Third Party Advisory

Timeline

Published: Jul 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-299655.5The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged opera CVE-2022-299669.8Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause CVE-2022-299677.5static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.CVE-2022-299687.8An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.CVE-2022-299696.1The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag CVE-2022-29978.0Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.CVE-2022-299707.5Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.CVE-2022-299717.8An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 thr CVE-2022-299727.8An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 CVE-2022-299734.7relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations invol CVE-2022-299744.3AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. This driver is, for example, used CVE-2022-299755.4An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .