Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.

Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.

The product stores sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.