Read the docs
TI-2018-03964 Aliases CVE-2018-5452GHSA-xq5r-4h6f-r3gp

Stack-based buffer overflow in Emerson ControlWave Micro Process Automation Controller

Priority LOW 37CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v.4.01.280] firmware: CWM v.05.78.00 and prior. A stack-based buffer overflow vulnerability caused by sending crafted packets on Port 20547 could force the PLC to change its state into halt mode.

Why it matters now

EPSS 0.02154 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Emerson ControlWave Micro Process Automation ControllerEmerson ControlWave Micro Process Automation Controller—No fix listedCNA
  • Emerson ControlWave Micro Process Automation Controller Vendor— Affected Emerson ControlWave Micro Process Automation Controller Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:emerson:controlwave_micro_firmware:*:*:*:*:*:*:*:*up to 05.78.00VulnerableEmerson
cpe:2.3:h:emerson:controlwave_micro:-:*:*:*:*:*:*:*not specified by NVDRunning onEmerson
  • cpe:2.3:o:emerson:controlwave_micro_firmware:*:*:*:*:*:*:*:* Versions up to 05.78.00 Vulnerable ·Emerson
  • cpe:2.3:h:emerson:controlwave_micro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Emerson

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5452
  2. 2026-10-03 Alias added: GHSA-xq5r-4h6f-r3gp

References

Advisory 1

  • TI-2022-12506 The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences