Emerson SE4027 Virtual I/o Module 2 Firmware vulnerabilities

5 CVEs affecting Emerson SE4027 Virtual I/o Module 2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-30260, published 2022-12-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-29964, published 2022-07-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded…
CVE-2022-29963, published 2022-07-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This…
CVE-2022-29962, published 2022-07-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects…
CVE-2022-29965, published 2022-07-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on…
CVE-2022-30260, published 2022-12-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This affects versions before 14.3 of DeltaV…