{"id":"CVE-2021-44463","state":"PUBLISHED","title":"Emerson DeltaV Uncontrolled Search Path Element","description":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.","publishedAt":"2022-01-28T19:09:50.632Z","updatedAt":"2025-04-17T15:51:38.177Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04"],"weaknesses":["CWE-427"],"ingestedAt":"2026-10-29T19:49:10.699Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/44xxx/CVE-2021-44463.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-44463","state":"PUBLISHED","datePublished":"2022-01-28T19:09:50.632Z","dateUpdated":"2025-04-17T15:51:38.177Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2021-12-16T00:00:00.000Z"},"containers":{"cna":{"title":"Emerson DeltaV Uncontrolled Search Path Element","descriptions":[{"lang":"en","value":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"icscert","dateUpdated":"2022-01-28T19:09:50.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6"},"credits":[{"lang":"en","value":"Sharon Brizinov of Claroty reported these vulnerabilities to Emerson."}],"datePublic":"2021-12-21T00:00:00.000Z","source":{"advisory":"ICSA-21-355-04","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","DATE_PUBLIC":"2021-12-21T15:34:00.000Z","ID":"CVE-2021-44463","STATE":"PUBLIC","TITLE":"Emerson DeltaV Uncontrolled Search Path Element"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"credit":[{"lang":"eng","value":"Sharon Brizinov of Claroty reported these vulnerabilities to Emerson."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04","refsource":"MISC","url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04"}]},"solution":[{"lang":"en"}],"source":{"advisory":"ICSA-21-355-04","discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-04","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T04:25:16.866Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-17T14:30:28.054050Z","id":"CVE-2021-44463","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-427","type":"CWE","lang":"en","description":"CWE-427 Uncontrolled Search Path Element"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-17T15:51:38.177Z"}}]}}}