Category
ICS / OT
4,112 known vulnerabilities.
425 results · Clear filters · Feed
-
Critical 9.8
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint th…
-
Critical 9.8
Remote Code Execution via Unauthenticated Configuration Manipulation
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
-
Critical 10.0
WAGO: Vulnerability in WAGO Device Sphere
A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices.
-
Critical 9.8
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W…
-
Critical 9.9
A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contai…
-
Critical 9.1
Information Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU module
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to read information in the product, to cause a Denial-of-Service (DoS…
-
Critical 9.0
Admin Authorized System File Deletion
System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: throug…
-
Critical 9.1
Admin Authorized System File corruption
File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through …
-
Critical 9.1
Admin Authorized Port (iptables) manipulation (open/close/disable ports)
Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX…
-
Critical 9.0
Authenticated Escalation to guest to root
An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.…
-
Critical 9.9
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.9
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.9
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.8
A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of a…
-
Critical 10.0
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in a…
-
Critical 9.9CVE-2025-2605 EPSS 16%
Authenticated command injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywe…
-
Critical 9.8
Insecure default settings for recorder products
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, an…
-
Critical 9.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
Critical 9.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
Critical 9.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
Critical 9.8
COMMGR - Insufficient Randomization Authentication Bypass
Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID and load and execute arbitrary code.
-
Critical 9.8
A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device …
-
Critical 10.0
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardco…
-
Critical 9.1
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected d…
-
Critical 9.1
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected d…
-
Critical 9.1
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected d…
-
Critical 9.2
Command Injection in NTP Setting
A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or …
-
Critical 9.8
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to ex…
-
Critical 9.1
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC…
-
Critical 9.8
A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS…
-
Critical 9.4
OneWireless command injection possible when updating firmware
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potenti…
-
Critical 9.8
Credentials Disclosure - keys
Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
-
Critical 9.3
Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extract passwords belonging to other users …
-
Critical 9.4CVE-2024-48852 Public exploit
Information disclosures
Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.
-
Critical 9.4CVE-2024-48849 Public exploit
Authentication and Authorization Issues
Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.
-
Critical 9.3
FactoryTalk® View Machine Editon - Remote Code Execution
A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a remote attacker to run commands or code as a high privileged user.
-
Critical 10.0CVE-2024-48841 Public exploit
Remote Code Execution (RCE) Vulnerabilities
Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older.
-
Critical 9.2
Frontend Authorization Logic Disclosure Vulnerability
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. T…
-
Critical 9.8
Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-…
-
Critical 9.3
Rockwell Automation PowerMonitor™ 1000 Denial of Service
A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing denial-of-service.