{"id":"CVE-2021-44463","aliases":["EUVD-2021-31300","GHSA-697r-pq44-hpff"],"status":"published","title":"Emerson DeltaV Uncontrolled Search Path Element","description":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00263,"percentile":0.18264,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-427"],"published":"2022-01-28T19:09:50Z","modified":"2026-06-17T04:12:23Z","products":[{"vendor":"emerson","product":"deltav"}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44463"},{"url":"https://github.com/advisories/GHSA-697r-pq44-hpff"}],"sources":{"cve":[{"id":"CVE-2021-44463","title":"Emerson DeltaV Uncontrolled Search Path Element","description":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.","status":"published","published":"2022-01-28T19:09:50.632Z","modified":"2025-04-17T15:51:38.177Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-31300","description":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.","status":"published","published":"2022-01-28T19:09:50Z","modified":"2025-04-17T15:51:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:21.05399Z"}],"ghsa":[{"id":"GHSA-697r-pq44-hpff","title":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege...","description":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.","status":"published","published":"2022-01-29T00:00:42Z","modified":"2023-01-27T05:01:46Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:41:57.859539Z"}],"nvd":[{"id":"CVE-2021-44463","description":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.","status":"published","published":"2022-01-28T20:15:12.137Z","modified":"2026-06-17T04:12:23.077Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:07:04.178977Z"}]}}