The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.

  - The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse     passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series     and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated     using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute     timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of     permutation operations resulting in three different four-character passwords corresponding to different     privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged     maintenance operations. NOTE: this is different from CVE-2014-2350. (CVE-2022-29965)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

The device may be vulnerable to flaws related to OT:ICEFALL. These vulnerabilities identify the insecure-by-design nature of OT devices and may not have a clear remediation path. As such, Nessus is unable to test specifically for these vulnerabilities but has identified the device to be one that was listed in the OT:ICEFALL report. Ensure your OT deployments follow best practices including accurate inventory, separation of environments, and monitoring. This plugin will trigger on any device seen by Tenable.OT that matches a family or model listed in the OT:ICEFALL report.

Note: All findings need to be manually verified based on the advisory from the vendor, once released.

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Severity
500698	Emerson DeltaV Distributed Control System Use of a Broken or Risky Cryptographic Algorithm (CVE-2022-29965)	Tenable OT Security	Tenable.ot	medium
500658	Emerson DeltaV Distributed Control System Use of Hard-Coded Credentials (CVE-2022-29962, CVE-2022-29963, CVE-2022-29964, CVE-2022-29965, CVE-2022-30261, CVE-2022-30263, CVE-2022-30266)	Tenable OT Security	Tenable.ot	medium

Detections

Analytics

CVE-2022-29965

medium

Tenable Plugins

medium

medium