Category
ICS / OT
4,112 known vulnerabilities.
4,112 results · Feed
-
Medium 5.9
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of …
-
Medium 5.3
Denial-of-Service Vulnerability in MELSEC iQ-F Series
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwor…
-
High 8.2
Integer underflow during processing of short network packets in CDA FTEB responder
The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in improper integer data value …
-
High 8.2
Incorrect response generation during FTEB protocol processing
The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in…
-
Critical 9.4
Lack of buffer clearing before reuse may result in incorrect system behavior.
The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could resul…
-
Medium 6.5
Lack of buffer clearing before reuse may result in incorrect system behavior.
The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, whic…
-
High 8.6
Lack of indexes’ validation against buffer borders leads to remote code execution.
The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index va…
-
High 7.5
Dereferencing of an uninitialized pointer leads to denial of service.
The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencin…
-
High 7.1
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB…
-
Medium 6.5
Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” P…
-
High 7.1
Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file wit…
-
High 7.1
Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file wit…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All v…
-
Medium 4.8
A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (Al…
-
Medium 5.3
A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (Al…
-
Medium 5.3
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP300) (All v…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications co…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications co…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications co…
-
High 8.8CVE-2025-40738 EPSS 14%
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly vali…
-
High 8.8CVE-2025-40737 EPSS 14%
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly vali…
-
Critical 9.8
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint th…
-
High 8.8
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected devices are vulnerable to SQL inje…
-
Medium 6.5
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0). The affected application allows to contro…
-
Medium 4.3
A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions…
-
High 7.8
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-p…
-
Medium 6.2
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly v…
-
High 8.1
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connec…
-
High 8.1
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connec…
-
High 7.0
A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (Al…
-
High 8.8
Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
-
High 8.8
Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
-
High 8.8
Phoenix Contact: File access due to the replacement of a critical file used by the watchdog
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
-
Medium 6.5
Phoenix Contact: DoS of the PLC due to incorrect default permissions possible
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.
-
High 8.8
OCPP Backend Configuration via Insecure Defaults
An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.
-
Critical 9.8
Remote Code Execution via Unauthenticated Configuration Manipulation
An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
-
High 8.4
Local Privilege Escalation via Unauthenticated Command Injection
An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.
-
High 8.8
Unauthenticated Configuration Access via Exposed API Endpoint
An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.
-
High 7.8
Privilege Escalation via Insecure SSH Permissions
A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.
-
High 7.8
Local Privilege Escalation via Vulnerable SSH Script
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.