Read the docs
TI-2025-32674 Aliases CVE-2025-52579GHSA-hfpv-gccv-qhv9

Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory

Priority MEDIUM 48CWE-316Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed ValveLink SOLO (Emerson): ValveLink 14.0ValveLink DTM (Emerson): ValveLink 14.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EmersonValveLink SOLObefore ValveLink 14.0ValveLink 14.0Patch availableCNA
EmersonValveLink DTMbefore ValveLink 14.0ValveLink 14.0Patch availableCNA
EmersonValveLink PRMbefore ValveLink 14.0ValveLink 14.0Patch availableCNA
EmersonValveLink SNAP-ONbefore ValveLink 14.0ValveLink 14.0Patch availableCNA
  • ValveLink SOLO VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA
  • ValveLink DTM VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA
  • ValveLink PRM VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA
  • ValveLink SNAP-ON VendorEmerson Affected before ValveLink 14.0 Fixed in ValveLink 14.0 Patch available CNA

Remediation

  • Fix · CNA ValveLink SOLO (Emerson) Fixed in ValveLink 14.0
  • Fix · CNA ValveLink DTM (Emerson) Fixed in ValveLink 14.0
  • Fix · CNA ValveLink PRM (Emerson) Fixed in ValveLink 14.0
  • Fix · CNA ValveLink SNAP-ON (Emerson) Fixed in ValveLink 14.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Emerson ValveLink DTM, ValveLink PRM and 2 more products ValveLink 14.0

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2025-32022 Emerson ValveLink Products Cleartext Storage of Sensitive Information in MemoryPriority LOW 38
    • TI-2025-29095 Emerson ValveLink Products Protection Mechanism FailurePriority LOW 38
    • TI-2025-33416 Emerson ValveLink Products Improper Input ValidationPriority LOW 26
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52579
  2. 2026-10-03 Alias added: GHSA-hfpv-gccv-qhv9

References

Other 3

  • TI-2022-26383 Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path CVSS 4.0HIGH 8.5
  • TI-2021-20526 Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file… CVSS 3.1CRITICAL 9.8
  • TI-2021-20521 Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in… CVSS 3.1CRITICAL 9.8
  • TI-2020-08552 ICSA-20-140-02 Emerson OpenEnterprise CVSS 3.1CRITICAL 10.0
  • TI-2013-02455 Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with… CVSS 2.0HIGH 10.0
  • TI-2013-00581 The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50… CVSS 2.0HIGH 10.0
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences