Category
ICS / OT
4,112 known vulnerabilities.
1,749 results · Clear filters · Feed
-
High 8.8
Insufficient Verification of Data Authenticity
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbi…
-
High 7.8
Untrusted Search Path
A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locatio…
-
High 7.5
Out-of-bounds Write in CODESYS Control
The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affect…
-
High 8.1
Incorrect Authorization in CODESYS Control
The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.
-
High 7.8
Incorrect Default Permissions in CODESYS Development System
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verifi…
-
High 7.8
Incorrect Default Permissions in CODESYS Development System
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation …
-
High 8.2
Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using…
-
High 7.8
Heap-based buffer overflow in Siemens Simcenter Femap
Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.
-
High 7.1
Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.
-
High 8.7
Insufficient Entropy vulnerability on Multiple Products
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
-
High 7.8
A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications co…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is …
-
High 7.5
A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V…
-
High 7.3
A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V…
-
High 7.7
Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding securit…
-
High 7.1
Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote…
-
High 7.5
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application is susceptible t…
-
High 7.5
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versi…
-
High 8.3
A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6…
-
High 7.5
The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests.…
-
High 8.2
Improper resource management in CODESYS Modbus TCP Server
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.
-
High 8.0
Phoenix Contact: Improper removal of sensitive information in MGUARD products
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
-
High 8.7
An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. B…
-
High 8.7
Improper timeout handling in CODESYS EtherNetIP
An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections.
-
High 7.8
Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application
It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that is then executed with adminis…
-
High 7.1
A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industria…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). …
-
High 8.8
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate …
-
High 7.3
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected application contains …
-
High 7.2
Wago: Vulnerability in WBM through Open VPN
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the a…
-
High 7.0
An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, fo…
-
High 8.1
CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability
Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1…
-
High 7.5
Backend Access Due to Insufficient Input Validation
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
-
High 7.5
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base sys…
-
High 7.5
CODESYS Control Audit Log Format String DoS
An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.
-
High 8.8
CODESYS Control Boot Application Replacement Enables Code Execution
A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
-
High 7.1
Cross‑Site Request Forgery in Link Aggregation Configuration
A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick authenticated users into sending unauthorized POST requests to the device by luring them to a malicious webpage. This can silently alter th…
-
High 7.1
Stored Cross‑Site Scripting in Link Aggregation Name Handling
A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected scrip…
-
High 7.2
Command Injection Vulnerability in Root CA Certificate Transfer Workflow
A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.
-
High 8.3
Configuration Data Spill
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.