CVE-2025-50109

The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects: Local Attack Vector (requires physical access or prior compromise), Low Complexity (no special conditions), No Privileges Required (any local user can exploit), and High impact to Confidentiality and Integrity. While CVSS 7.7 is substantial, the local-only attack vector significantly constrains real-world exploitation compared to network-based vulnerabilities. Real-world risk depends on: (1) whether Emerson has published EPSS data (critical for probability assessment), (2) KEV catalog inclusion (indicates active exploitation in the wild), and (3) PoC availability. In industrial environments, local access is often easier than assumed due to maintenance personnel, shared workstations, or prior lateral movement. The HIGH confidentiality impact is the primary concern—attackers gaining cleartext secrets could pivot to further compromise ICS networks. This should be prioritized moderately-to-high depending on KEV/EPSS signals and deployment density.

An attacker gains local shell access to a workstation or ICS gateway running Emerson ValveLink software (via phishing, USB drop, or prior vulnerability). The attacker runs a simple file-system search (e.g., 'grep -r "password" ~/.valvelink/config/', 'strings /opt/valvelink/data.db', or examining process memory) and discovers cleartext credentials, API tokens, or encryption keys stored by the ValveLink application. With these credentials, the attacker can: authenticate to connected valve control systems, modify setpoints/configurations, or pivot to upstream SCADA/HMI systems. No special privileges (PR:N) are required—any local user can perform this reconnaissance. The attack is not user-interactive (UI:N), making it automatable in privilege escalation chains. In a shared ICS environment (e.g., vendor maintenance terminal, shared historian workstation), this scenario is highly plausible. If PoC code exists demonstrating automated credential extraction, exploitability is significantly elevated.