CVE-2025-46358: Emerson ValveLink Privilege Escalation

CVE-2025-46358 Overview

CVE-2025-46358 affects Emerson ValveLink products used in industrial control system (ICS) environments. The flaw is categorized under [CWE-693] Protection Mechanism Failure. The software either does not use a protection mechanism or uses one incorrectly, leaving it unable to defend against directed attacks. A local attacker with no privileges and no user interaction can leverage the weakness to compromise confidentiality and integrity of the ValveLink application data. CISA published advisory ICSA-25-189-01 to coordinate disclosure with operators of affected operational technology (OT) assets.

Critical Impact
Local attackers without authentication can bypass protection mechanisms in Emerson ValveLink software to compromise high-value ICS configuration and process data.

Affected Products

Emerson ValveLink SOLO
Emerson ValveLink DTM
Emerson ValveLink SNAP-ON application

Discovery Timeline

2025-07-11 - CVE CVE-2025-46358 published to the National Vulnerability Database (NVD)
2025-07-11 - CISA releases ICS advisory ICSA-25-189-01
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-46358

Vulnerability Analysis

The weakness in Emerson ValveLink stems from a missing or incorrectly applied protection mechanism. Such mechanisms typically include integrity verification, signed configuration handling, authentication on local interprocess channels, or tamper-resistant storage of sensitive data. When these controls are absent or misused, the application cannot resist a directed local attack that targets its trust assumptions.

The attack vector is local, meaning an actor must already have access to the engineering workstation or host running ValveLink. Once present, the attacker requires no privileges and no user interaction. The impact covers high confidentiality and integrity loss, including manipulation of valve configuration data, calibration values, and diagnostic outputs that influence physical processes.

ValveLink software is used by instrumentation engineers to configure FIELDVUE digital valve controllers across refining, chemical, power, and water utilities. Tampering with this trust boundary can propagate manipulated parameters to safety-relevant field devices.

Root Cause

The root cause is a [CWE-693] Protection Mechanism Failure. The ValveLink software relies on protections that are either absent, disabled by default, or implemented in a way that does not resist a targeted local adversary. Examples include unauthenticated local services, unsigned configuration files, or weak validation of input from co-located processes.

Attack Vector

An attacker with local access to the workstation running ValveLink targets the missing protection layer to read or modify sensitive application state. No credentials are required. Because the impact reaches valve controller configuration, downstream effects can include altered process parameters delivered to field devices over HART or FOUNDATION Fieldbus.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the CISA ICS Advisory ICSA-25-189-01 for vendor-supplied technical details.

Detection Methods for CVE-2025-46358

Indicators of Compromise

Unexpected modifications to ValveLink configuration databases, project files, or calibration records on engineering workstations.
Local process activity that reads or writes ValveLink installation directories from non-ValveLink binaries.
New or modified scheduled tasks, services, or auto-start entries on hosts running ValveLink SOLO, DTM, or SNAP-ON.

Detection Strategies

Baseline file integrity on ValveLink program directories and configuration stores, and alert on changes outside vendor update windows.
Monitor for non-interactive logons and lateral movement to engineering workstations that host ValveLink.
Correlate Windows process creation events (Event ID 4688) with unexpected child processes spawned under the ValveLink installation path.

Monitoring Recommendations

Ship endpoint, authentication, and ICS host telemetry to a centralized data lake for cross-correlation with OT network sensors.
Track HART or fieldbus traffic for unexpected parameter writes to FIELDVUE controllers managed by the affected workstation.
Alert on new local accounts, privilege changes, or removable media events on hosts running Emerson ValveLink.

How to Mitigate CVE-2025-46358

Immediate Actions Required

Apply the Emerson-provided update for ValveLink as referenced in Emerson Security Notifications and Emerson Software Downloads.
Restrict interactive and remote access to engineering workstations running ValveLink to a minimum set of named operators.
Inventory all ValveLink installations and confirm version levels against the patched build identified by Emerson.

Patch Information

Emerson has published security notifications and updated software builds for affected ValveLink products. Operators should obtain the corrected installer from the Emerson Software Downloads portal and apply it during a planned maintenance window. CISA tracks remediation guidance in ICSA-25-189-01.

Workarounds

Segment engineering workstations onto a dedicated OT VLAN with no direct connectivity from corporate networks, following ISA/IEC 62443 zone and conduit design.
Enforce application allowlisting on ValveLink hosts to block unauthorized binaries from executing in the user context.
Disable removable media and limit local administrator rights on workstations running ValveLink until patching is complete.

bash

# Configuration example: restrict local logon to authorized ICS engineers (Windows)
secedit /export /cfg current.inf
# Edit current.inf and set:
#   SeInteractiveLogonRight = DOMAIN\ICS-Engineers
#   SeRemoteInteractiveLogonRight = DOMAIN\ICS-Engineers
secedit /configure /db secedit.sdb /cfg current.inf /overwrite

# Enable file integrity auditing on the ValveLink directory
auditpol /set /subcategory:"File System" /success:enable /failure:enable
icacls "C:\Program Files (x86)\Emerson Process Management\ValveLink" /setaudit "Everyone:(OI)(CI)F"