CVE-2018-19021 Auth bypass in Emerson DeltaV

What is CVE-2018-19021?

CVE-2018-19021 is a medium-severity authentication bypass vulnerability in Emerson DeltaV, published on 25 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service.

Weakness: CWE-307

Which versions are affected by CVE-2018-19021?

It affects 1 product.

Products include Emerson Deltav.

How do I fix CVE-2018-19021?

No fix has been published for CVE-2018-19021 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-19021 being exploited?

There is no known exploitation of CVE-2018-19021 in the wild and no public exploit code.

Other vulnerabilities in Emerson DeltaV

• CVE-2018-14793 Memory corruption in DeltaV High 8.8
• CVE-2018-14795 Path traversal in DeltaV High 8.8
• CVE-2021-44463 Emerson DeltaV Uncontrolled Search Path Element High 8.1
• CVE-2018-14791 Privilege escalation in DeltaV DCS High 7.8
• CVE-2018-14797 Other in DeltaV DCS High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qpcc-rcr6-2cj9.