Category
ICS / OT
4,112 known vulnerabilities.
1,749 results · Clear filters · Feed
-
High 7.8
A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Upd…
-
High 8.3
A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versi…
-
High 7.8
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code whe…
-
High 8.2
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATI…
-
High 7.5
A vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD…
-
High 7.1
A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA A…
-
High 7.8
Improper File Permissions Allow Local Privilege Escalation
A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.
-
High 8.1
Session ID Basic Auth Bypass
The ASPECT system allows users to bypass authentication. This issue affects all versions of ASPECT
-
High 8.4
Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation
A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat ac…
-
High 8.4
Rockwell Automation Stack-based Buffer Overflow In Arena® Simulation
A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat ac…
-
High 8.4
Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation
A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat ac…
-
High 7.5
CODESYS Control DoS via Unauthenticated NULL Pointer Dereference
An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
-
High 8.3
CODESYS Control PKI Exposure Enables Remote Certificate Access
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain…
-
High 7.5
HTTP Service DoS Vulnerability
An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80.
-
High 7.0
Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers
Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute…
-
High 7.2
A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is …
-
High 7.2
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote comman…
-
High 8.9
A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generat…
-
High 8.2
Integer underflow during processing of short network packets in CDA FTEB responder
The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in improper integer data value …
-
High 8.2
Incorrect response generation during FTEB protocol processing
The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in…
-
High 8.6
Lack of indexes’ validation against buffer borders leads to remote code execution.
The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index va…
-
High 7.5
Dereferencing of an uninitialized pointer leads to denial of service.
The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencin…
-
High 7.1
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB…
-
High 7.1
Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file wit…
-
High 7.1
Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file wit…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All v…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications co…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications co…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications co…
-
High 8.8CVE-2025-40738 EPSS 14%
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly vali…
-
High 8.8CVE-2025-40737 EPSS 14%
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly vali…
-
High 8.8
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected devices are vulnerable to SQL inje…
-
High 7.8
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-p…
-
High 8.1
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connec…
-
High 8.1
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connec…
-
High 7.0
A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (Al…
-
High 8.8
Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
-
High 8.8
Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
-
High 8.8
Phoenix Contact: File access due to the replacement of a critical file used by the watchdog
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
-
High 8.8
OCPP Backend Configuration via Insecure Defaults
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.