Emerson vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-50930 Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code High 8.5 · Jan 13, 2026
• CVE-2025-52579 Emerson ValveLink Products store sensitive information in cleartext in memory.Critical 9.3 · Jul 10, 2025
• CVE-2025-50109 Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.High 8.5 · Jul 10, 2025
• CVE-2025-46358 Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the productHigh 8.5 · Jul 10, 2025
• CVE-2023-51761 In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabiliHigh 8.3 · Feb 8, 2024
• CVE-2023-46687 In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context frCritical 9.8 · Feb 8, 2024
• CVE-2022-30260 Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature).High 7.8 · Dec 26, 2022
• CVE-2022-30262 The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity.High 7.8 · Aug 17, 2022
• CVE-2022-30264 The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations.Critical 9.8 · Aug 16, 2022
• CVE-2022-29957 The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication.High 7.8 · Jul 26, 2022
• CVE-2020-10640 Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a sCritical 10 · Feb 24, 2022
• CVE-2020-10632 Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cauHigh 8.8 · Feb 24, 2022
• CVE-2021-45421 Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing.High 7.5 · Feb 14, 2022
• CVE-2021-45420 Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utCritical 9.8 · Feb 14, 2022
• CVE-2021-44463 Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and High 8.1 · Jan 28, 2022
• CVE-2021-45427 Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal.Critical 9.8 · Dec 30, 2021
• CVE-2021-42542 The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.High 8 · Oct 22, 2021
• CVE-2021-42540 The affected product is vulnerable to a unsanitized extract folder for system configuration.High 8 · Oct 22, 2021
• CVE-2021-42539 The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings chHigh 8 · Oct 22, 2021
• CVE-2021-42538 The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input.High 8 · Oct 22, 2021
• CVE-2021-42536 The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.High 8 · Oct 22, 2021
• CVE-2021-38485 The affected product is vulnerable to improper input validation in the restore file.High 8 · Oct 22, 2021
• CVE-2020-12030 There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled.Critical 10 · Sep 29, 2021
• CVE-2021-27461 A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.High 7.5 · May 20, 2021
• CVE-2021-27459 A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.Critical 9.8 · May 20, 2021