noindex and left out of the sitemap until more data is confirmed.CVE-2025-52579 is a cleartext-storage-of-sensitive-information flaw in Emerson's ValveLink device-management software (SOLO, DTM, PRM, SNAP-ON): sensitive data held in memory can end up on disk, in a crash dump, or left over after a crash, where a local user with access to the host can read it; NVD has deferred to CISA's own CVSS assessment rather than publishing an independent score, so this page stays noindex until an "Analyzed" status is recorded.
Vulnerability summary
N/A
Not yet scored
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2025-07-11
Published
Vulnerability ID: CVE-2025-52579 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Emerson ValveLink | — | ValveLink SOLO, DTM, PRM, SNAP-ON: versions prior to 14.0 (per CISA Advisory ICSA-25-189-01); not yet a published NVD CPE applicability statement |
What this means
CVE-2025-52579 is a cleartext storage of sensitive information in memory vulnerability (CWE-316) in Emerson ValveLink SOLO, DTM, PRM and SNAP-ON. NVD's description states the sensitive memory "might be saved to disk, stored in a core dump, or remain uncleared if the product crashes," at which point a local user with access to the host can read it (NVD).
NVD tracks CVE-2025-52579 with status "Deferred" as of 2026-10-22. Unusually, the CVSS score on file was itself submitted by CISA's ICS-CERT rather than Emerson: CVSS v3.1 9.4 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, and CVSS v4.0 9.3. Because NVD's overall vulnerability status is still "Deferred" rather than "Analyzed," this page leaves cvss_score unset rather than presenting that figure as a completed NVD analysis (NVD).
CISA's advisory ICSA-25-189-01, published 2025-07-08, covers CVE-2025-52579 alongside four related CVEs in the same ValveLink advisory (CVE-2025-50109, CVE-2025-46358, CVE-2025-48496, CVE-2025-53471) and states that "successful exploitation of these vulnerabilities could allow an attacker with access to the system to read sensitive information stored in cleartext, tamper with parameters, and run unauthorized code." All affected ValveLink products are fixed in version 14.0 or later (CISA ICS Advisory ICSA-25-189-01).
CISA's advisory reports no known public exploitation of this CVE at the time of publication, and recommends network isolation, firewall protection and VPN-only remote access for ValveLink hosts as compensating controls (CISA ICS Advisory ICSA-25-189-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.0039 (31.3th percentile) — low, consistent with a flaw that requires pre-existing local access to the host rather than being remotely, unauthenticated exploitable over a network (CISA KEV, FIRST EPSS).
Because NVD's own status is still "Deferred" rather than a completed independent analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, ValveLink operators should update to version 14.0 or later and restrict which accounts have any login access to hosts running ValveLink.
Evidence
- ValveLink stores sensitive information in cleartext in memory; it can be written to disk, captured in a core dump, or left uncleared after a crash, readable by a local user (CWE-316). — NVD
- NVD status is "Deferred" with a CISA ICS-CERT-submitted CVSS v3.1 9.4 / v4.0 9.3; no independently-analyzed NVD score or CPE configuration as of 2026-10-22. — NVD
- Affects ValveLink SOLO/DTM/PRM/SNAP-ON prior to version 14.0, disclosed alongside four related CVEs in the same advisory; fixed in 14.0. — CISA ICS Advisory ICSA-25-189-01
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.0039 (31.3th percentile) as of 2026-10-22. — FIRST EPSS
