Emerson ValveLink Products Cleartext Storage of Sensitive Information Vulnerability

A vulnerability exists in Emerson ValveLink products, including ValveLink SOLO, DTM, PRM, and SNAP-ON, all versions prior to 14.0. These products store sensitive information in cleartext in memory, which could be saved to disk, included in a core dump, or left uncleared after a crash. This vulnerability could allow an attacker to read sensitive information, tamper with parameters, and execute unauthorized code.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, manipulation of system parameters, and execution of unauthorized code on the affected system.

Remediation

Users are advised to update to ValveLink 14.0 or later. The update is available on the Emerson website. For more information, refer to the Emerson security notification regarding ValveLink.