Category
ICS / OT
4,112 known vulnerabilities.
425 results · Clear filters · Feed
-
Critical 9.8
Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or Function
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a single UDP packet.
-
Critical 9.1
Heap Based Buffer Overflow in PTC KEPServerEx
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.
-
Critical 9.8
WAGO: OS Command Injection Vulnerability in Managed Switch
A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling…
-
Critical 9.6
A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in m…
-
Critical 9.1
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with admini…
-
Critical 9.6
A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in S…
-
Critical 9.6
A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache valida…
-
Critical 10.0CVE-2023-4699 Public exploit
Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi…
-
Critical 9.1
Information Disclosure, Information Tampering and Authentication Bypass Vulnerability in MELSEC-F Series main module
Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequence programs from the product or write malicious sequence programs or improper data in the product wi…
-
Critical 9.8
A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a S…
-
Critical 9.8
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug s…
-
Critical 9.8
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary cod…
-
Critical 9.8CVE-2023-5399 EPSS 36%
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that coul…
-
Critical 9.8
A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfe…
-
Critical 9.8
Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer Overflow
A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat act…
-
Critical 9.3
Malicious Code Execution Vulnerability in FA Engineering Software Products
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a deni…
-
Critical 9.9
Printer web page invalid command execution
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to…
-
Critical 9.8CVE-2023-2071 EPSS 17%
FactoryTalk View Machine Edition Vulnerable to Remote Code Execution
Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP…
-
Critical 9.8
MXsecurity Authentication Bypass
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.
-
Critical 9.8
Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. I…
-
Critical 9.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerabl…
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i8…
-
Critical 9.6
PHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices
In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute …
-
Critical 10.0
PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.
-
Critical 9.8
Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially cra…
-
Critical 9.8
Controller stack overflow on decoding messages from the server
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Controller design flaw - unsigned firmware
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
DoS due to heap overflow
Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Controller stack overflow when decoding messages from the server
Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Server DoS due to heap overflow
Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.8
Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP mess…
-
Critical 9.6
Rockwell Automation Enhanced HIM Vulnerable to Cross-Site Request Forgery Attack
The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) …
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.1
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.9
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper acce…
-
Critical 9.8
Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely execute arbitrary code.