Multiple Emerson Process Management RTUs Hardcoded Credentials Security Bypass Vulnerability

Bugtraq ID:	62667
Class:	Design Error
CVE:	CVE-2013-0694
Remote:	Yes
Local:	No
Published:	Sep 26 2013 12:00AM
Updated:	Dec 24 2014 12:55AM
Credit:	Dillon Beresford, Brian Meixell, Marc Ayala and Eric Forner of Cimation
Vulnerable:
Not Vulnerable:

Multiple Emerson Process Management RTUs Hardcoded Credentials Security Bypass Vulnerability

Multiple Emerson Process Management RTUs including ROC800, DL8000, and ROC800L are prone to a security-bypass vulnerability caused by hard-coded credentials.

An attacker can leverage this issue to gain access to the vulnerable device.

The following versions are affected:

ROC800 3.50 and prior
DL8000 2.30 and prior
ROC800L 1.20 and prior

Multiple Emerson Process Management RTUs Hardcoded Credentials Security Bypass Vulnerability

Attackers can exploit this issue using browser or readily available tools.

Multiple Emerson Process Management RTUs Hardcoded Credentials Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Emerson Process Management RTUs Hardcoded Credentials Security Bypass Vulnerability

References:

• Emerson Electric Co Homepage (Emerson Electric Co)