CVE-2022-29965

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.

• CWE-327

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory

Published

Jul 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29959Emerson OpenBSI through 2022-04-29 mishandles credential sto…5.5
• CVE-2022-2996A flaw was found in the python-scciclient when making an HTT…7.4
• CVE-2022-29960Emerson OpenBSI through 2022-04-29 uses weak cryptography. I…5.5
• CVE-2022-29962The Emerson DeltaV Distributed Control System (DCS) controll…5.5
• CVE-2022-29963The Emerson DeltaV Distributed Control System (DCS) controll…5.5
• CVE-2022-29964The Emerson DeltaV Distributed Control System (DCS) controll…5.5
• CVE-2022-29967static_compressed_inmemory_website_callback.c in Glewlwyd th…7.5
• CVE-2022-29968An issue was discovered in the Linux kernel through 5.17.5. …7.8
• CVE-2022-29969The RSS extension before 2022-04-29 for MediaWiki allows XSS…6.1
• CVE-2022-2997Session Fixation in GitHub repository snipe/snipe-it prior t…8
• CVE-2022-29970Sinatra before 2.2.0 does not validate that the expanded pat…7.5
• CVE-2022-29971An argument injection vulnerability in the browser-based aut…7.8