CVE-2018-19021

lowpriority · track · 26EPSS 0.007 · 54 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.72% (54th) EPSS

CVSS 3.3 · low

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedDeltaV DCScisa_csaf_ot
DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, and R6
MitigationDeltaV DCScisa_csaf_ot
For more information, please refer to the article for this vulnerability on the Emerson website.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.3–8.8

v2.03.3lowAV:A/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 6.5 · impact 2.9

v3.16.5mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.08.8highCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Hsecondary · CISA US

v3.16mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-307USprimaryCWE-307US

affected products (9)

Products and version ranges known to be affected.

DeltaV DCS: Versions 11.3.1 11.3.2 12.3.1 13.3.1 14.3 R5.1 R6 and priorall versionscisa_csaf_otUS
Emerson DeltaV DCS≤ 11.3.1 | 11.3.2 | 12.3.1 | 13.3.1 | 14.3 | R5.1 | <= R6cisa_csaf_otUS
Emerson Emerson DeltaV≤ DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior.enisa_euvdEU
emerson deltav= 11.3.1nvdUScpe:2.3:a:emerson:deltav:*:*:*:*:*:*:*:*
emerson deltav= 11.3.2nvdUScpe:2.3:a:emerson:deltav:*:*:*:*:*:*:*:*
emerson deltav= 12.3.1nvdUScpe:2.3:a:emerson:deltav:*:*:*:*:*:*:*:*
emerson deltav= 13.3.1nvdUScpe:2.3:a:emerson:deltav:*:*:*:*:*:*:*:*
emerson deltav= 14.3nvdUScpe:2.3:a:emerson:deltav:*:*:*:*:*:*:*:*
emerson deltavr5.1 → r6nvdUScpe:2.3:a:emerson:deltav:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-19-010-01Emerson DeltaV2019-01-10icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to shut down a service, resulting in a denial of service.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

published 2019-01-25modified 2026-06-17

related (825)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2019-17240US	critical9.8	39.6% (99th)	Exploit	2019-10-06
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
CVE-2020-15906US	critical9.8	27.2% (98th)	Exploit	2020-10-22
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
CVE-2016-9361US	critical9.8	20.4% (97th)	Exploit	2017-02-13
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions…
CVE-2003-1096US	high10.0	10.5% (96th)	Exploit	2003-12-31
The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier for remote attackers to gain pri…
CVE-2023-27100US	critical9.8	9.84% (96th)	Exploit	2023-03-22
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to byp…

+820 more

references (7)

External citations — patches, advisories, analysis.

https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01 cnnvd
https://www.emerson.com/Patchcnnvd
https://www.securityfocus.com/bid/106522 cnnvd
http://www.securityfocus.com/bid/106522 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01 enisa_euvd
http://www.securityfocus.com/bid/106522Third Party AdvisoryVDB Entrynvd
https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan