No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Emerson
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-52579 | CWE-316 Cleartext Storage of Sensitive Information in Memory | 9.4 Critical |
The product stores sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it. Mitigation: Emerson recommends users update their Valvelink software to ValveLink 14.0 or later. The upgrade can be downloaded from the Emerson website. ↗ Mitigation: For more information see the associated Emerson security notification. ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-46358 | CWE-693 Protection Mechanism Failure | 7.7 High |
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. Mitigation: Emerson recommends users update their Valvelink software to ValveLink 14.0 or later. The upgrade can be downloaded from the Emerson website. ↗ Mitigation: For more information see the associated Emerson security notification. ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-50109 | CWE-316 Cleartext Storage of Sensitive Information in Memory | 7.7 High |
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. Mitigation: Emerson recommends users update their Valvelink software to ValveLink 14.0 or later. The upgrade can be downloaded from the Emerson website. ↗ Mitigation: For more information see the associated Emerson security notification. ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-48496 | CWE-427 Uncontrolled Search Path Element | 5.1 Medium |
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Mitigation: Emerson recommends users update their Valvelink software to ValveLink 14.0 or later. The upgrade can be downloaded from the Emerson website. ↗ Mitigation: For more information see the associated Emerson security notification. ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-53471 | CWE-20 Improper Input Validation | 5.1 Medium |
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Mitigation: Emerson recommends users update their Valvelink software to ValveLink 14.0 or later. The upgrade can be downloaded from the Emerson website. ↗ Mitigation: For more information see the associated Emerson security notification. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-52579 | 9.4 Critical | Emerson ValveLink SOLO Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, o… |
| CVE-2025-46358 | 7.7 High | Emerson ValveLink SOLO Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against … |
| CVE-2025-50109 | 7.7 High | Emerson ValveLink SOLO Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere. |
| CVE-2025-48496 | 5.1 Medium | Emerson ValveLink SOLO Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control… |
| CVE-2025-53471 | 5.1 Medium | Emerson ValveLink SOLO Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are require… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.