PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9347 Emerson CVE debrief

CVE-2016-9347 is a medium-severity issue affecting Emerson DeltaV Wireless I/O Cards running firmware v13.3. The problem is that SSH is enabled unnecessarily on the SE4801T0X and SE4801T1X cards, increasing the management exposure of the device. Defenders should verify whether these cards are present, limit SSH exposure, and follow the linked vendor or ICS-CERT guidance for supported hardening steps.

Vendor
Emerson
Product
Unknown
CVSS
MEDIUM 5
CISA KEV
Not listed in stored evidence
Original CVE published
2016-09-02
Original CVE updated
2025-06-05
Advisory published
2016-09-02
Advisory updated
2025-06-05

Who should care

OT/ICS operators using Emerson DeltaV Wireless I/O Cards, plant network and security teams, and administrators responsible for managing SE4801T0X or SE4801T1X devices running firmware v13.3.

Technical summary

The supplied NVD record says Emerson SE4801T0X Redundant Wireless I/O Card V13.3 and SE4801T1X Simplex Wireless I/O Card V13.3 are affected because SSH functionality is enabled unnecessarily. NVD maps the issue to CWE-254 and rates it CVSS v3.0 5.0 with vector AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating adjacent-network exposure, high attack complexity, and low impact to confidentiality, integrity, and availability.

Defensive priority

Medium: the score is moderate, but this still matters in industrial environments because it exposes an unnecessary management service on affected DeltaV wireless I/O cards.

Recommended defensive actions

  • Inventory DeltaV Wireless I/O Cards to confirm whether SE4801T0X or SE4801T1X devices are running firmware v13.3.
  • Review Emerson and ICS-CERT guidance for supported hardening or mitigation steps for CVE-2016-9347.
  • If SSH is not required for your operational workflow, restrict or disable access using vendor-supported configuration methods.
  • Segment the OT network so only approved management hosts can reach the affected devices.
  • Validate any configuration change in a maintenance window and monitor for unexpected SSH access attempts.

Evidence notes

The supplied corpus includes the NVD entry, which lists the affected CPEs for SE4801T0X firmware 13.3 and SE4801T1X firmware 13.3, the CVSS v3.0 vector, and CWE-254. It also references SecurityFocus BID 94586 and the ICS-CERT advisory ICSA-16-334-03. No exploit code or weaponized reproduction details are present in the supplied sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9347 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9347

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9347 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9347

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.