Skip to content
OpenAdvisories
Critical VDE-2024-002 6 CVEs

Pilz: Multiple products affected by uC/HTTP vulnerability

Published Feb 6, 2024 · Updated Feb 6, 2024

Vendor: Pilz Product: PIT gb RLLE y down ETH Product: PIT gb RLLE y up ETH Product: PITreader base unit (HR 01) Product: PITreader base unit (HR 02) Product: PITreader card unit Product: PITreader S base unit Product: PITreader S card unit

Summary

The PITreader product family is using the 3rd -party-component uC/HTTP to implement the web server functionality. uC/HTTP is affected by multiple vulnerabilities. These vulnerabilities may enable an attacker to gain full control over the system.

Details

Impact
An unauthenticated attacker can exploit the vulnerabilities by sending specially crafted HTTP packets to the system. Depending on the vulnerability, memory content can be overwritten or corrupted. In a worst-case scenario this can be used by the attacker to execute arbitrary code on the system to gain full control over it.

Remediation
Install the fixed firmware version. Please visit the Pilz Website to download the latest firmware update. Instructions about installing the firmware update can be found in the user manual.
Limit network access to legitimate connections by using a firewall or similar measures.

Vulnerabilities 6

Revision history

  1. #1

    Initial revision.

References