Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday disclosed multiple hardware vulnerabilities in Emerson’s ValveLink products.... The post Manufacturing systems at risk as CISA reveals ValveLink vulnerabilities in Emerson equipment appeared first on Industrial Cyber.
Analysis Summary
# Vulnerability: Emerson ValveLink Critical Vulnerabilities (Cleartext Storage, Protection Failure, Path Issues)
## CVE Details
- CVE ID: CVE-2025-52579, CVE-2025-50109, CVE-2025-46358 (and others referenced but not fully detailed)
- CVSS Score: 9.4 (CRITICAL) for CVE-2025-52579; 8.5 (HIGH) for CVE-2025-50109 (CVSS v4 scores provided)
- CWE: Cleartext Storage of Sensitive Information in Memory (CWE-312 related for CVE-2025-52579), Protection Mechanism Failure, Uncontrolled Search Path Elements
## Affected Systems
- Products: Emerson ValveLink SOLO, DTM, PRM, SNAP-ON
- Versions: All versions released before version 14.0
- Configurations: Deployed in global critical manufacturing sector environments.
## Vulnerability Description
CISA disclosed multiple hardware vulnerabilities in Emerson's ValveLink products. The primary critical flaw (CVE-2025-52579) involves the **cleartext storage of sensitive information in memory**. This data could be saved to disk, included in core dumps, or remain uncleared if a crash occurs or the programmer fails to properly clear memory.
Other vulnerabilities include:
1. **Protection Mechanism Failure (CVE-2025-46358):** The product does not use or incorrectly uses a protection mechanism offering insufficient defense against directed attacks.
2. **Improper Input Validation** and **Uncontrolled Search Path Elements** were also identified.
## Exploitation
- Status: Not explicitly stated as actively exploited in the wild, but vulnerabilities are disclosed by CISA and stem from vendor reporting through structured programs, suggesting awareness.
- Complexity: Implied to be lower for memory disclosure (cleartext) and protection mechanism flaws leading to unauthorized code execution or parameter tampering.
- Attack Vector: Dependent on the specific flaw, but successful exploitation allows an attacker **with access to the system** to read sensitive information, tamper with parameters, and run unauthorized code.
## Impact
Successful exploitation could allow an attacker with system access to:
- **Confidentiality:** Read sensitive information stored in cleartext.
- **Integrity:** Tamper with product parameters.
- **Availability:** Run unauthorized code, potentially leading to disruption.
## Remediation
### Patches
- Emerson has released fixes. Users must upgrade to **ValveLink version 14.0 or later**.
### Workarounds
- The provided article snippet does not detail specific workarounds, focusing primarily on the CISA advisory announcement and the availability of the patch.
## Detection
- **Indicators of Compromise (IoCs):** Not detailed in the summary provided. Focus should be on anomalous memory access or unexpected changes to ValveLink system parameters.
- **Detection Methods and Tools:** Monitoring memory utilization and system state changes within the controlled environment. Reviewing core dumps for evidence of sensitive data exposure.
## References
- Vendor Advisories: CISA ICS Advisory (ICSA-25-189-01)
- Relevant Links:
- [cisa.gov/news-events/ics-advisories/icsa-25-189-01](https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01) (Defanged: cisa[.]gov/news-events/ics-advisories/icsa-25-189-01)