Read the docs
TI-2025-32022 Aliases CVE-2025-50109GHSA-gqm3-pxvj-g2xq

Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory

Priority LOW 38CWE-316Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed ValveLink SOLO (Emerson): ValveLink 14.0ValveLink DTM (Emerson): ValveLink 14.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EmersonValveLink SOLObefore ValveLink 14.0ValveLink 14.0Patch availableCNA
EmersonValveLink DTMbefore ValveLink 14.0ValveLink 14.0Patch availableCNA
EmersonValveLink PRMbefore ValveLink 14.0ValveLink 14.0Patch availableCNA
EmersonValveLink SNAP-ONbefore ValveLink 14.0ValveLink 14.0Patch availableCNA
  • ValveLink SOLO VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA
  • ValveLink DTM VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA
  • ValveLink PRM VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA
  • ValveLink SNAP-ON VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA

Remediation

  • Fix · CNA ValveLink SOLO (Emerson) Fixed in ValveLink 14.0
  • Fix · CNA ValveLink DTM (Emerson) Fixed in ValveLink 14.0
  • Fix · CNA ValveLink PRM (Emerson) Fixed in ValveLink 14.0
  • Fix · CNA ValveLink SNAP-ON (Emerson) Fixed in ValveLink 14.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Emerson ValveLink DTM, ValveLink PRM and 2 more products ValveLink 14.0

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2025-32674 Emerson ValveLink Products Cleartext Storage of Sensitive Information in MemoryPriority MEDIUM 48
    • TI-2025-29095 Emerson ValveLink Products Protection Mechanism FailurePriority LOW 38
    • TI-2025-33416 Emerson ValveLink Products Improper Input ValidationPriority LOW 26
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-50109
  2. 2026-10-03 Alias added: GHSA-gqm3-pxvj-g2xq

References

Other 3

  • TI-2022-26383 Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path CVSS 4.0HIGH 8.5
  • TI-2021-20526 Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file… CVSS 3.1CRITICAL 9.8
  • TI-2021-20521 Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in… CVSS 3.1CRITICAL 9.8
  • TI-2020-08552 ICSA-20-140-02 Emerson OpenEnterprise CVSS 3.1CRITICAL 10.0
  • TI-2013-02455 Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with… CVSS 2.0HIGH 10.0
  • TI-2013-00581 The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50… CVSS 2.0HIGH 10.0
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences