CVE-2014-2349
Emerson DeltaV Use of Improper Authorization
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
Exploit likelihood
What each source reports
CVE List Score used
Emerson DeltaV Use of Improper Authorization
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
- Record
CVE-2014-2349- CVSS 2.0
- 6.2
AV:L/AC:L/Au:S/C:N/I:C/A:C - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2014-2386
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
- Record
EUVD-2014-2386- CVSS 2.0
- 6.2 Medium
AV:L/AC:L/Au:S/C:N/I:C/A:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gfxv-w659-vp5r No score
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 allows local users to modify or read configuration...
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 allows local users to modify or read configuration files by leveraging engineering-level privileges.
- Record
GHSA-gfxv-w659-vp5r- Weakness
- CWE-285, CWE-798
- Updated
- 2026-11-02
NVD
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
- Record
CVE-2014-2349- CVSS 2.0
- 6.2 Medium
AV:L/AC:L/Au:S/C:N/I:C/A:C - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-285, CWE-264
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2349 is a vulnerability (CVSS 6.2) in Emerson Deltav, published May 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. No source names a fixed version.