CVE-2021-42542

Executive Summary

CVE-2021-42542 affects Emerson WirelessHART Gateways, a family of industrial network bridges that connect WirelessHART field devices to host control systems in process automation environments. The vulnerability is a directory traversal flaw resulting from the gateway's mishandling of the backup folder structure during backup and restore operations. An authenticated attacker — or an unauthenticated attacker if default credentials are in use — can exploit the flaw to write files outside the intended backup directory, potentially enabling arbitrary file upload, configuration manipulation, or full device compromise. With a CVSS score of 8.0 (High), this vulnerability poses a significant risk to OT environments where WirelessHART gateways serve as critical infrastructure between the sensor network and the control system.

Technical Analysis

The NVD description states that the affected product is "vulnerable to directory traversal due to mishandling of provided backup folder structure." This indicates a path traversal vulnerability (CWE-22) in the gateway's backup/restore functionality.

Vulnerability Mechanism (Inferred from Vulnerability Class):

Directory traversal vulnerabilities of this class exploit insufficient validation of user-supplied paths. When the gateway's backup function receives a folder name or path component from the user, the lack of proper sanitization allows an attacker to include traversal sequences (e.g., ../) to escape the intended backup directory. Because the vulnerability concerns the "provided backup folder structure," the attack likely occurs through a filename or directory-name parameter submitted as part of a backup or restore operation.

Since the NVD description does not disclose specific endpoint names, parameters, or function names, the exact attack surface remains opaque. However, from the architecture of Emerson WirelessHART Gateways — which typically expose HTTP/HTTPS management interfaces and proprietary field protocols — the vulnerable function is most likely exposed through the device's web-based configuration interface. These gateways commonly support:

• Configuration backup and restore via the web interface
• Firmware update mechanisms
• Wireless network management and diagnostics

The backup folder structure mishandling suggests the device creates directory structures based on user-supplied names during backup operations with insufficient traversal-sequence filtering. This enables path traversal payloads such as ../../ in folder or file names, causing the device to write files to arbitrary locations on the filesystem.

Attack Surface:

• Network Layer: The gateway is typically accessible over Ethernet/IP networks for configuration and data forwarding. The vulnerable backup functionality is most likely reachable via the HTTP/HTTPS management web server or an authenticated API endpoint.
• Authentication: Given the CVSS vector includes PR:L (low privilege), authentication is required, though "low privilege" in embedded device contexts often means merely possessing a default or minimally privileged account.
• Field Protocol Layer: Emerson's WirelessHART networks use a mesh protocol between field instruments and the gateway, but the backup functionality is management-plane, not field-plane, making remote HTTP access the primary vector.

Attack Complexity:

The LOW complexity rating (AC:L) indicates no special conditions are required beyond reaching the backup/restore function. No user interaction is needed (UI:N), and the scope is unchanged (S:U) — meaning the compromise does not naturally extend to other security boundaries beyond the gateway itself, though in OT environments, gateway compromise frequently enables lateral movement to the host control system network.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2021-42542. The attack chain described below is inferred from the vulnerability class (directory traversal via backup folder mishandling) and the CVSS vector, not from observed exploits.

Step 1 — Reconnaissance / Target Identification

Attackers identify Emerson WirelessHART Gateways using network discovery techniques:

• Shodan/Censys search for exposed Emerson devices listening on common industrial control system ports or web management ports (typically 80/443/8080)
• ICS/SCADA protocol fingerprinting to identify WirelessHART gateways
• Internal network scanning once initial access to the OT network is achieved (e.g., via phishing or a compromised engineering workstation)

Step 2 — Triggering the Vulnerability

The attacker authenticates to the gateway's management interface using either:

• Compromised credentials (phishing, credential stuffing, or weak/default passwords)
• A legitimate low-privilege account on the OT network

Once authenticated, the attacker navigates to the backup/restore configuration page (endpoint unknown from public data) and submits a backup operation request containing traversal sequences in the folder name parameter. Example of the vulnerability-class payload: a folder name of ../../../ + target path + crafted filename.

Since the CVSS configuration indicates attacks require authenticated low-privilege access, the attacker needs at least a valid account on the gateway. In embedded devices, reduced authentication granularity often means any valid account gives full access to all management functions.

Step 3 — Payload Execution / File Write

The directory traversal flaw allows the attacker to specify traversal sequences in the backup folder name, causing the device to write the backup archive (or related files) to an arbitrary filesystem location. Depending on the file system permissions of the gateway's backup service, the attacker may target:

• Configuration files: Overwriting settings to alter network parameters, authentication rules, or routing behavior
• Firmware/update directories: Staging malicious firmware images for later execution
• Web root directories: Uploading web shells or malicious content that executes upon subsequent HTTP requests
• System startup areas: Planting scripts that execute on reboot

The full impact depends on what execution privileges accompany the file write. In many embedded OT devices, the backup service runs with elevated privileges, enabling write to critical system directories.

Step 4 — Post-Exploitation Impact

Following successful exploitation, the attacker could:

• Disrupt operations by corrupting gateway configuration — WirelessHART devices may lose connectivity to the host system
• Inject malicious configuration that redirects plant data to attacker-controlled destinations
• Use the compromised gateway as a pivot point into the broader OT network — WirelessHART gateways often sit between Level 0/1 field devices and Level 2/3 supervisory systems

Chained attack vector: If the attacker achieves remote code execution via the traversal (e.g., by writing a malicious file that is later interpreted by the gateway's services), the gateway can be used to attack connected host systems, potentially impacting ICS availability and integrity as described by the CVSS impact of HIGH for both confidentiality and integrity.

Impact Assessment

CVSS Analysis (Score: 8.0/High):

• Attack Vector: Network (AV:N) — The vulnerability is exploitable remotely over the network. In OT environments, the gateway is typically accessible only from the OT LAN, but may be reachable from corporate networks through misconfigurations or VPN exposure.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions are required; the backup function is standard on the device.
• Privileges Required: Low (PR:L) — Only low-privilege credentials are needed, which on embedded control devices often means any default account.
• User Interaction: None (UI:N) — No victim action required beyond the attacker's own requests.
• Scope: Unchanged (S:U) — Impact is contained to the gateway device itself (no cross-scope effect).

Business Impact:

1. Operational Availability: A compromised or corrupted WirelessHART gateway can sever the connection between wireless field instruments and the control system, producing loss of real-time process visibility. For continuous-process industries (refineries, chemical plants, power generation), loss of instrument telemetry can trigger partial plant shutdowns or safety-system interventions.

2. Data Integrity: If the attacker writes modified configuration files, the gateway could forward falsified instrument readings to the control system, potentially causing operators to make incorrect decisions. This affects product quality, safety, and regulatory compliance (e.g., emissions monitoring).

3. Security Posture Degradation: The gateway serves as a bridge between wireless field networks (containing safety and control instrumentation) and the wired control network. Compromise erodes the security boundary separating these zones.

4. Confidentiality: If the attacker writes a web shell to the gateway's web server directory, all data passing through the gateway — including process measurements, instrument statuses, and network topology information — becomes exfiltratable.

Affected Systems:

Emerson WirelessHART Gateways running firmware versions prior to v4.7.105. The vendor has not published the full affected version range in the provided data, but all versions before the patch are presumed vulnerable.

Blast Radius:

• Directly: The specific wireless gateway instance (e.g., Emerson 1420 and 1410 WirelessHART Gateway models may be affected, but specific model confirmation is unavailable from the provided data)
• Indirectly: All WirelessHART field devices connected to the gateway (typically hundreds of sensors), the wired host control network, and connected engineering workstations

Detection Guidance

Sigma Rule

title: Emerson WirelessHART Gateway Backup Directory Traversal Attempt
id: c9f4f6a2-8e3b-4a7d-9c5e-1f2a8b3d4c5e
status: experimental
description: Detects HTTP requests to Emerson WirelessHART Gateway management interfaces containing path traversal sequences in backup-related parameters
author: Valtersit Threat Intelligence Team
date: 2024-01-15
logsource:
  category: webserver
  product: emerson
  service: wirelesshart_gateway
detection:
  selection_parent:
    cs-method: POST||GET
    cs-uri-extension: 
      - '*backup*'
      - '*restore*'
      - '*upload*'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '%252e%252e%252f'
      - '....//'
  condition: selection_parent and selection_traversal
falsepositives:
  - Legitimate backup operations using relative paths (rare)
level: high
tags:
  - attack.t1190
  - attack.t1083
  - cve.2021-42542

YARA Rule

rule CVE_2021_42542_Emerson_WirelessHART_Traversal
{
    meta:
        author = "Valtersit Threat Intelligence Team"
        description = "Detects directory traversal payloads targeting Emerson WirelessHART Gateways backup functionality"
        cve = "CVE-2021-42542"
        date = "2024-01-15"
        score = 70
    strings:
        // Traversal sequences commonly used in exploitation
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..%2f" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide nocase
        $traversal4 = "%252e%252e%252f" ascii wide nocase
        // Backup-related keywords in the request
        $backup1 = "backup" ascii wide nocase
        $backup2 = "restore" ascii wide nocase
        $backup3 = "folder" ascii wide nocase
        $file1 = ".tar" ascii wide nocase
        $file2 = ".zip" ascii wide nocase
        $file3 = ".dat" ascii wide nocase
    condition:
        // Must be a backup/restore request AND contain traversal sequences
        uint16(0) == 0x4D5A or uint32(0) == 0x504B0304 or true and 
        ((filesize < 1MB or true) and 
        (any of ($backup*) or any of ($file*)) and
        (any of ($traversal*)))
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Emerson WirelessHART Gateway Directory Traversal (CVE-2021-42542)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"backup"; nocase; http.uri; content:"restore"; nocase; http.uri; content:"folder"; nocase; pcre:"/(?:\.\.\/|\.\.%2f|%2e%2e%2f|%252e%252e%252f)/Ri"; classtype:attempted-admin; sid:2024042; rev:1; reference:cve,2021-42542; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2021-42542;)

Elastic Detection

// Detection for Emerson WirelessHART Gateway backup directory traversal
// Requires HTTP transaction logs (filebeat module for HTTP or custom HTTP log integration)

sequence by source.ip with maxspan=5m
  // Step 1: Authentication to gateway (post-auth detection)
  [ network where network.protocol == "http"
    and http.request.method == "POST"
    and http.request.body.text contains "login"
    and destination.port in (80, 443, 8080) ]
  // Step 2: Backup request containing traversal sequence
  [ network where network.protocol == "http"
    and http.request.method in ("GET", "POST")
    and (http.request.body.text contains "../"
         or http.request.body.text contains "..%2f"
         or http.request.body.text contains "%2e%2e%2f"
         or url.path contains "../"
         or url.path contains "%2e%2e%2f")
    and (http.request.body.text contains "backup"
         or http.request.body.text contains "restore"
         or url.path contains "backup"
         or url.path contains "restore")
    and destination.port in (80, 443, 8080) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis OR sourcetype=pan:traffic
| where match(uri,"(?i)(backup|restore|folder|upload)")
  AND match(uri,"(\.\./|\.\.%2f|%2e%2e%2f|%252e%252e%252f)")
| eval traversal_type = case(
    match(uri,"%252e") , "double-encoded",
    match(uri,"%2e") , "url-encoded",
    match(uri,"%2f") , "url-encoded-slash",
    match(uri,"\.\./") , "plain",
    true, "other"
  )
| eval risk_score = case(
    traversal_type == "double-encoded" , 90,
    traversal_type == "url-encoded" , 80,
    traversal_type == "plain" , 70,
    true, 50
  )
| stats count by src_ip, dest_ip, uri, http_method, traversal_type, risk_score
| where count > 0
| sort - risk_score
| table _time, src_ip, dest_ip, http_method, uri, traversal_type, count, risk_score
| eval alert_tier = if(risk_score >= 80, "CRITICAL", if(risk_score >= 70, "HIGH", "MEDIUM"))

Wazuh OSSEC Rule

<group name="emerson,">
  <!-- CVE-2021-42542: Emerson WirelessHART Gateway directory traversal in backup folder handling -->
  <rule id="100842" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.\./|\.\.%2f|%2e%2e%2f|%252e%252e%252f</field>
    <field name="url">(?i)(backup|restore|folder|upload)</field>
    <description>Emerson WirelessHART Gateway: Directory traversal attempt in backup/restore operation (CVE-2021-42542)</description>
    <group>cve-2021-42542,exploit_attempt,path_traversal,ics,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <alert>
      <level>12</level>
      <title>Directory Traversal in Emerson WirelessHART Gateway Backup</title>
      <description>An HTTP request to an Emerson WirelessHART Gateway contains traversal sequences in backup/restore-related parameters, indicating possible exploitation of CVE-2021-42542.</description>
    </alert>
  </rule>

  <!-- Higher severity for double-encoded variants (bypass attempts) -->
  <rule id="100843" level="14">
    <decoded_as>json</decoded_as>
    <field name="url">%252e%252e%252f|%2e%2e%2f|%252e%252e%255c</field>
    <field name="url">(?i)(backup|restore|folder|upload)</field>
    <description>Emerson WirelessHART Gateway: Encoded directory traversal bypass attempt in backup operation (CVE-2021-42542)</description>
    <group>cve-2021-42542,exploit_attempt,path_traversal,ics,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <alert>
      <level>14</level>
      <title>Encoded Traversal in Emerson Gateway Backup Request</title>
      <description>Double-encoded or URL-encoded traversal sequence detected in backup/restore request to Emerson WirelessHART Gateway — likely attempts to bypass input filtering.</description>
    </alert>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

The sole patch source is the CNA (Emerson as the CNA). This has not been independently verified through field testing or a second advisory source. Detection rules, system audits, and long-term mitigation should account for the possibility that the patch is incomplete or introduces regression issues.

Immediate Mitigations (Pre-Patch)

1. Restrict Management Access: Limit access to the gateway's management interface to only trusted hosts on the OT network. Implement allow-lists for sources permitted to reach the management web server (ports 80/443 or whichever the gateway uses).

2. Disable Remote Access: If the gateway is exposed to the internet or corporate network, immediately isolate it. The gateway should only be accessible from engineering workstations and the L2 control network segment.

3. Change Default Credentials: If the gateway is using default credentials (factory settings), change them to strong, unique passwords. Audit all accounts and remove unnecessary ones.

4. Monitor Backup Operations: Enable logging on the gateway and monitor all backup/restore transactions. Pay attention to folder names containing traversal sequences. Use the Sigma/Elastic/Splunk rules above to detect attempts.

5. Limit Backup Functionality: If the gateway supports restricting backup/restore operations to specific roles or directories, enable the most restrictive settings. Disable automatic backup scheduling if unused.

Patch/Upgrade Steps

1. Upgrade the Emerson WirelessHART Gateway firmware to v4.7.105 to address CVE-2021-42542.
2. Access the Emerson Gate Firmware site to obtain the update. If you do not have a free Guardian account, follow the updated Emerson Gateway Firmware download process described in the vendor download guide.
3. Before applying the patch: back up the current gateway configuration, document current settings and network parameters, and schedule the upgrade during a maintenance window to minimize plant disruption.
4. After upgrade: verify gateway firmware version, validate that all WirelessHART field devices continue communicating correctly, re-verify backup/restore functionality (ensure traversal sequences no longer work), and confirm configuration settings survived migration.

Long-Term Hardening

1. Network Segmentation: Place WirelessHART gateways on a dedicated OT segment with strict firewall rules preventing access from corporate networks. Implement DMZ-style architecture if remote monitoring is required.

2. Asset Management: Maintain an inventory of all Emerson WirelessHART Gateways, including firmware versions. Subscribe to Emerson security advisories and track firmware update availability.

3. Patch Management Process: Establish a defined process for evaluating and deploying OT firmware patches — balance uptime requirements against security risk. For devices with CVE-2021-42542 severity (CVSS 8.0), prioritize patch deployment.

4. Monitoring: Deploy the detection rules from this report into your SIEM/EDR stack. Monitor for HTTP requests containing traversal sequences and backup operations from unexpected sources.

5. Vendor Engagement: Since patch confidence is only 2/4 (single source), contact Emerson support to confirm the patch scope and ensure v4.7.105 fully addresses the traversal flaw. Request the vendor's security advisory for CVE-2021-42542 for official documentation and configuration hardening guidance.

6. Incident Response Preparations: Develop a playbook for OT device compromise, including isolation procedures for affected gateways, device replacement steps, and forensic data collection methods compatible with proprietary OT devices.

7. ICS/SCADA Security Assessment: Include WirelessHART gateway review in periodic security assessments — verify authentication mechanisms, review audit logs, and test backup/restore functionality for residual traversal issues.

References

1. NVD Entry (Primary CVE Reference): https://nvd.nist.gov/vuln/detail/CVE-2021-42542 — Official NVD description, CVSS score, and vulnerability metadata.

2. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2021-42542 is NOT listed in the KEV catalog, indicating no confirmed exploitation in the wild as of the catalog's latest update.

3. Emerson Automation Solutions Security Advisory: https://www.emerson.com/en-us/support — Emerson's product security advisories page (firmware v4.7.105 patch reference; official download via Emerson Gate Firmware site).

4. MITRE ATT&CK Framework: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique, relevant for characterizing the attack methodology used against exposed Emerson gateways.

5. FIRST EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ — EPSS score for CVE-2021-42542 is 0.01391 (69.8th percentile of exploited CVEs), indicating a moderate likelihood of exploitation but not among the most actively targeted vulnerabilities.

Threat Actor Intelligence: No known threat actor campaigns specifically targeting CVE-2021-42542 have been publicly documented as of report date. The vulnerability exists in the OT asset class that is commonly targeted by state-sponsored APT groups (e.g., those targeting critical infrastructure), but no specific campaign attribution is available. The EPSS percentile (69.8%) places this vulnerability above the median in exploitation likelihood, suggesting it may be leveraged in future campaigns. The absence from the CISA KEV catalog indicates no confirmed in-the-wild exploitation as of the most recent KEV update.