Summary
The affected products integrate the vulnerable libraries in a way so that the vulnerabilities can't be exploited remotely without prior authentication.
Details
Mitigation
It is recommended to disable all user accounts with restricted configuration write permissions if the update to the latest released version cannot be installed immediately.It is further recommended to use best practice password policies.
Remediation
Update firmware to the latest version available. The issues have been resolved with IRF1000 version 1.5.0, IRF2000 version 4.4.0 and IRF3000 version 1.2.0.
Vulnerabilities 18
-
Unscored —CVE-2014-3669 EPSS 29%
Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.…
-
Unscored —
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…
-
Unscored —
Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP thr…
-
Unscored —
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…
-
Unscored —
The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and …
-
Unscored —CVE-2015-2787 EPSS 12%
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…
-
Unscored —
SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-depende…
-
Unscored —
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which a…
-
Unscored —CVE-2015-4602 EPSS 10%
The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5…
-
Unscored —
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var…
-
Unscored —
Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exc…
-
Unscored —CVE-2016-10161 EPSS 13%
The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x bef…
-
Unscored —CVE-2016-7124 EPSS 16%
ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which al…
-
Unscored —
ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote a…
-
Unscored —
PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows rem…
-
Unscored —
In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial …
-
Unscored —
The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.…
-
Unscored —
The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects t…
Revision history
-
#1
Initial revision.
References
-
VDE-2023-009: ads-tec: Multiple Vulnerabilities in IRF1000, IRF2000 and IRF3000 - HTML
https://certvde.com/en/advisories/VDE-2023-009/
-
Vendor PSIRT
https://www.ads-tec-iit.com
-
CERT@VDE Security Advisories for ads-tec Industrial IT GmbH
https://certvde.com/en/advisories/vendor/ads-tec-iit/