CVE-2018-11691 (GCVE-0-2018-11691)

Vulnerability from cvelistv5 – Published: 2019-05-14 15:09 – Updated: 2024-08-05 08:17
VLAI?
Summary
Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches’ management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson’s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:17:08.428Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-01"
          },
          {
            "name": "109110",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/109110"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches\u2019 management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson\u2019s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-11T07:06:03",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-01"
        },
        {
          "name": "109110",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/109110"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-11691",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches\u2019 management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson\u2019s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf",
              "refsource": "MISC",
              "url": "http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf"
            },
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsa-19-190-01",
              "refsource": "MISC",
              "url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-01"
            },
            {
              "name": "109110",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/109110"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-11691",
    "datePublished": "2019-05-14T15:09:34",
    "dateReserved": "2018-06-03T00:00:00",
    "dateUpdated": "2024-08-05T08:17:08.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:emerson:ve6046_firmware:09.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1CCF066D-BAE6-4E29-8079-27BA1798F32A\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:emerson:ve6046:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"03F17F44-79D5-4463-AD37-29013D540AA0\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches\\u2019 management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson\\u2019s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool.\"}, {\"lang\": \"es\", \"value\": \"La aplicaci\\u00f3n Emerson DeltaV Smart Switch Command Center, disponible en las versiones 11.3.xy 12.3.1, no pudo cambiar la contrase\\u00f1a de administraci\\u00f3n de DeltaV Smart Switches al momento de la puesta en servicio. Emerson lanz\\u00f3 parches para las estaciones de trabajo DeltaV para abordar este problema, y los parches se pueden descargar desde el Portal de Soporte Guardian de Emerson. Consulte la Notificaci\\u00f3n de seguridad DeltaV DSN19003 (KBA NK-1900-0808) para obtener m\\u00e1s informaci\\u00f3n sobre este problema. Las versiones 13.3 y posteriores de DeltaV usan la aplicaci\\u00f3n Centro de comando de dispositivos de red para administrar los conmutadores inteligentes DeltaV, y esta nueva aplicaci\\u00f3n no se ve afectada por este problema. Despu\\u00e9s de reparar el Smart Switch Command Center, los usuarios deben comisionar los DeltaV Smart Switches o cambiar la contrase\\u00f1a con la herramienta.\"}]",
      "id": "CVE-2018-11691",
      "lastModified": "2024-11-21T03:43:50.057",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 10.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-05-14T16:29:01.360",
      "references": "[{\"url\": \"http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf\", \"source\": \"cve@mitre.org\", \"tags\": [\"Product\"]}, {\"url\": \"http://www.securityfocus.com/bid/109110\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.us-cert.gov/ics/advisories/icsa-19-190-01\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Product\"]}, {\"url\": \"http://www.securityfocus.com/bid/109110\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.us-cert.gov/ics/advisories/icsa-19-190-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-11691\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-05-14T16:29:01.360\",\"lastModified\":\"2024-11-21T03:43:50.057\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches\u2019 management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson\u2019s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool.\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n Emerson DeltaV Smart Switch Command Center, disponible en las versiones 11.3.xy 12.3.1, no pudo cambiar la contrase\u00f1a de administraci\u00f3n de DeltaV Smart Switches al momento de la puesta en servicio. Emerson lanz\u00f3 parches para las estaciones de trabajo DeltaV para abordar este problema, y los parches se pueden descargar desde el Portal de Soporte Guardian de Emerson. Consulte la Notificaci\u00f3n de seguridad DeltaV DSN19003 (KBA NK-1900-0808) para obtener m\u00e1s informaci\u00f3n sobre este problema. Las versiones 13.3 y posteriores de DeltaV usan la aplicaci\u00f3n Centro de comando de dispositivos de red para administrar los conmutadores inteligentes DeltaV, y esta nueva aplicaci\u00f3n no se ve afectada por este problema. Despu\u00e9s de reparar el Smart Switch Command Center, los usuarios deben comisionar los DeltaV Smart Switches o cambiar la contrase\u00f1a con la herramienta.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:emerson:ve6046_firmware:09.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CCF066D-BAE6-4E29-8079-27BA1798F32A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:emerson:ve6046:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03F17F44-79D5-4463-AD37-29013D540AA0\"}]}]}],\"references\":[{\"url\":\"http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\"]},{\"url\":\"http://www.securityfocus.com/bid/109110\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.us-cert.gov/ics/advisories/icsa-19-190-01\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"http://www.securityfocus.com/bid/109110\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.us-cert.gov/ics/advisories/icsa-19-190-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.