Summary
An attacker can exploit multiple vulnerabilities in VibroLine and AvibiaLine devices to gain unauthorized access or execute a denial of service attack.
Product
The VibroLine and AvibiaLine devices are a condition monitoring solution for industrial applications
Vulnerabilities 7
-
Critical 9.8
Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced.
-
High 8.8
Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration
An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet is enabled.
-
High 7.7
Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USB
A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.
-
High 7.5
Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.
-
High 7.5
Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP)
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP).
-
Medium 6.5
Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (RS485)
An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485).
-
Medium 6.5
Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via CAN
A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.
Revision history
-
#1
Initial publication