Emerson Electric vulnerabilities
We track 5 vulnerabilities in Emerson Electric products across 5 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 2, 2023.
Latest Emerson Electric vulnerabilities
- 9.4 Critical severity
DL8000: Improper Authentication
ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.
- 7.8 High severity
Proficy Machine Edition: Unrestricted Upload of File with Dangerous Type
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.
- 7.8 High severity
Proficy Machine Edition: Insufficient Verification of Data Authenticity
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.
- 7.5 High severity
Proficy Machine Edition: Improper Access Control
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists.
- 7.3 High severity
Proficy Machine Edition: Improper Limitation of a Pathname to a Restricted Directory
Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file