CVE-2025-50109

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-316

Affected software

VendorProductVersions
EmersonValveLink SOLO< ValveLink 14.0
EmersonValveLink DTM< ValveLink 14.0
EmersonValveLink PRM< ValveLink 14.0
EmersonValveLink SNAP-ON< ValveLink 14.0

References

Timeline

Published
Jul 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-50114.7A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admiCVE-2025-501108.8An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse mCVE-2025-50128.8The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads dueCVE-2025-501219.5A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause uCVE-2025-501228.9A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reveCVE-2025-501237.2A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a priCVE-2025-501247.2A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a prCVE-2025-501256.3A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the serverCVE-2025-501265.3A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to injeCVE-2025-501278.5A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL comCVE-2025-501286.1A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev masteCVE-2025-501298.8A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding th
CVE-2025-50109: High severity, CVSS 7.7 | Vulnix