199 results · Clear filters · Feed
-
Critical max 9.8VDE-2023-037 1 CVE
WAGO: Remote Code execution vulnerability in managed Switches
Affected products are vulnerable to remote code execution via command injection in the web-based management by an attacker.
-
Critical max 9.8
Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability
The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60b) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilitie…
first Sep 13, 2023 -
Critical max 9.8
Phoenix Contact: Multiple products affected by WIBU Codemeter Vulnerability (Update A)
A Vulnerability in WIBU-SYSTEMS CodeMeter Runtime affects multiple Phoenix Contact products. Phoenix Contact devices using CodeMeter embedded are not affected by this vulnerability. Update A, 2023-11-13 Removed CVE-2023-4701 because it was revoked.
first Sep 19, 2023 -
Critical max 9.8
WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime
UPDATE A: Solution has updated release datesUPDATE B: Solution has updated release datesThis Advisory is published with reference to: CODESYS Advisory 2022-11 (Security update for CODESYS Control V2) CODESYS Advisory 2022-12 (Security update for CODESYS V2 pa…
first Oct 17, 2022 -
Critical max 9.8VDE-2023-038 3 CVEs
Frauscher: Multiple Vulnerabilities in FDS101
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are prone to multiple vulnerabilities which could lead up to a full compromise of the FDS101 device.
-
CriticalVDE-2023-009 18 CVEs
ads-tec: Multiple Vulnerabilities in IRF1000, IRF2000 and IRF3000
The affected products integrate the vulnerable libraries in a way so that the vulnerabilities can't be exploited remotely without prior authentication.
-
Critical max 9.8VDE-2022-061 1 CVE
VARTA: Multiple devices prone to hard-coded credentials
VARTA energy storage systems have a web user interface via which users and installers can access live data measurements and configure the system to their needs. It has been discovered that the corresponding credentials are hard-coded within the frontend and t…
-
Critical max 9.8VDE-2022-060 4 CVEs
WAGO: Multiple vulnerabilities in web-based management of multiple products
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. The configuration backend can in some cases be used without authentication and to write data with root privileges. Add…
-
Critical max 9.1VDE-2022-055 1 CVE
WAGO: Exposure of configuration interface in unmanaged switches
An unknown and undocumented configuration interface with limited functionality was identified on the affected devices.
-
Critical max 9.8VDE-2022-043 3 CVEs
Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family
Multiple Wiesemann & Theis product families are affected by multiple vulnerabilities in the web interface.
-
Critical max 9.8VDE-2022-023 1 CVE
TRUMPF TruTops prone to improper access control
During the installation of specific TRUMPF Windows applications, privileged local users with default usernames and passwords are created. An adversary could use these users to access and compromise the affected Windows systems and, under certain circumstances…
-
Critical max 7.5VDE-2022-039 20 CVEs
Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual
Multiple vulnerabilities have been found in myREX24 and myREX24.virtual.
-
Critical max 7.5VDE-2021-003 18 CVEs
MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 (Update A)
Multiple vulnerabilities have been found in mymbCONNECT24 and mbCONNECT24. Update A, 2022-09-07: Affected Products: updated affected versions due to incomplete fixes of some CVEs. See Solution for details. Solution: updated version information. Solution: Adde…
-
Critical max 9.9VDE-2022-035 6 CVEs
WAGO: Multiple product series affected by multiple CODESYS vulnerabilities
Multiple WAGO product families are prone to multiple vulnerabilities affecting CODESYS control runtime system.
-
Critical max 5.9VDE-2022-032 73 CVEs
AUMA: Multiple Vulnerabilities in Automation Runtime NTP Service
The SIMA2 Master Station features an NTP service based on ntpd, a reference implementation of the Network Time Protocol (NTP). Affected SIMA2 Master Stations with software version < V2.6 include an outdated version of ntpd which is affected by a large number …
-
Critical max 9.8VDE-2022-030 1 CVE
Lenze: Vulnerability in the OPC-UA authentification connection in the firmware
The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon s…
-
Critical max 6.5VDE-2022-019 8 CVEs
Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components
For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.
-
Critical max 9.1VDE-2022-018 2 CVEs
PHOENIX CONTACT: Multiple vulnerabilities in RAD-ISM-900-EN-BD devices
Multiple vulnerabilities have been discovered in the firmware and in libraries utilized of RAD-ISM-900-EN-BD devices: In addition to the above listed CVEs the following issues were identified: Vulnerabilities related to outdated libraries: BusyBox version 0.6…
-
Critical max 9.8VDE-2022-016 1 CVE
TRUMPF: TruTops Fab, TruTops Boost prone to vulnerability
A service function in the stated TRUMPF products is exposed without necessary authentication. Execution of this function may result in unauthorized access to, change of data or disruption of the whole service.
-
Critical max 8.1VDE-2021-055 10 CVEs
Pilz: PMC programming tool 2.x.x affected by multiple vulnerabilities
The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a wo…
-
Critical max 9.9VDE-2021-054 18 CVEs
Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system
Several Pilz products use Versions V2 and V3 of the CODESYS runtime system from CODESYS GmbH, which enables the execution of IEC 61131-3 PLC programs. These runtime environments contain several vulnerabilities, which an attacker can exploit via the network. S…
-
Critical max 9.9VDE-2021-061 27 CVEs
Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities
The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a wo…
-
Critical max 9.8VDE-2021-047 7 CVEs
Bender/ebee: Multiple Charge Controller Vulnerabilities
Bender is publishing this advisory to inform customers about multiple security vulnerabilities in the Charge Controller product families.Bender has analysed the weaknesses and determined that the electrical safety of the devices is not concerned. To Benders k…
-
Critical max 9.8VDE-2022-008 9 CVEs
WEIDMUELLER: Multiple vulnerabilities in Modbus TCP/RTU Gateways
Multiple issues have been found in the affected products. See CVE descriptions for details.
-
Critical max 8.2VDE-2021-050 12 CVEs
WAGO: Multiple devices affected by Vulnerabilities in NUCLEUS TCP Stack.
Multiple vulnerabilities were reported in the Nucleus Real-Time Operating System (RTOS). The Nucleus RTOS is an essential component in several WAGO PLCs and fieldbus coupler. WAGO uses older Versions of the Nucleus RTOS also in legacy products. For additional…
-
CriticalVDE-2021-048 3 CVEs
Lenze: Multiple Vulnerabilities in CODESYS Control V2 communication
The affected products contain a CODESYS Control runtime system in version V2. They are therefore affected by the vulnerability described in CODESYS Advisory 2021-06. It provides a communication server for the communication with clients like the CODESYS Develo…
-
Critical max 7.5VDE-2021-033 8 CVEs
TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities
The TruControl laser control software (versions 1.04 to 3.0.0) uses CODESYS runtime versions affected by multiple CVEs: **CVE list:** - CVE-2021-29242 - CVE-2021-29241 - CVE-2019-5105 - CVE-2020-7052 - CVE-2019-9012 - CVE-2019-9010 - CVE-2019-9009 - CVE-2018-…
-
Critical max 8.8VDE-2020-049 4 CVEs
Phoenix Contact: Multiple vulnerabilities in PLCnext Control devices < 2021.0 LTS
Multiple vulnerabilities have been identified in PLCnext Control devices. Please consult the aforementioned CVE-IDs.
-
CriticalVDE-2020-043 1 CVE
Bender: COMTRAXX < 4.2.0 affected by inadquate credentials check vulnerability
Bender is publishing this advisory to inform customers about a security vulnerability in all devices running the COMTRAXX software. The user authorization is validated for most, but not all routes in the system. A user with knowledge about the routes can read…
-
Critical max 9.8VDE-2020-040 5 CVEs
Pepperl+Fuchs: Multiple Products prone to multiple vulnerabilities in Comtrol RocketLinux
Several critical vulnerabilities within Firmware have been identified. Please consult the CVEs for details.
-
CriticalVDE-2020-034 6 CVEs
Pepperl+Fuchs: VMT MSS and VMT IS - Several vulnerabilities in products utilizing WIBU-SYSTEMS CodeMeter components
Several vulnerabilities have been discovered in the utilized component WIBU-SYSTEMS CodeMeter Runtime. For detailed information please refer to WIBU-SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html
-
CriticalVDE-2020-030 3 CVEs
PHOENIX CONTACT: Products utilizing WIBU-SYSTEMS CodeMeter components
Several vulnerabilities have been discovered in WIBU-SYSTEMS CodeMeter and published 08 September 2020. Phoenix Contact is only affected by a subset of these vulnerabilities. Phoenix Contact products are not affected by vulnerabilities WIBU-200521-01 (CVE-202…
-
CriticalVDE-2020-015 1 CVE
WAGO: Web Based Management - Code Execution Vulnerability
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. An attacker needs an authorized login with administrative privileges on the device in order to exploit the herein ment…
-
Critical max 9.8VDE-2020-018 1 CVE
PHOENIX CONTACT: FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT: PPPD vulnerable to CVE-2020-8597
FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT devices are affected by a buffer overflow vulnerability within the PPP service. The PPP service is not active by default, but is used commonly at TC ROUTER, TC CLOUD CLIENT. It is also running in the followi…
-
Critical max 10.0VDE-2020-016 1 CVE
SWARCO: Critical Vulnerability in CPU LS4000
An open port used for debugging grants root access to the device without access control via network.
-
CriticalVDE-2020-010 1 CVE
WAGO: Cloud Connectivity Remote Code Execution Vulnerability
An attacker needs an authorized login with administrative privileges on the device in order to exploit the herein mentioned vulnerability. The weakness allows an attacker which has admin privileges on the device to redirect to his own Azure cloud account and …
-
CriticalVDE-2019-022 7 CVEs
WAGO: Multiple Vulnerabilities in I/O-Check Service in Multiple Devices
The reported vulnerabilities allow a remote attacker to change the setting, delete the application, set the device to factory defaults, code execution and to cause a system crash or denial of service. Note(s) The following products are affected by the listed …
-
Critical max 9.8
Pepperl+Fuchs: Remote code execution vulnerability in HMI devices
A remote code execution vulnerability exists in **Remote Desktop Services** – formerly known as **Terminal Services** – when an unauthenticated attacker connects to the target system using **RDP** and sends specially crafted requests. This vulnerability is **…
first May 29, 2019 -
Critical max 8.8VDE-2019-013 19 CVEs
WAGO: Multiple Vulnerabilities in industrial managed switches
Multiple vulnerabilities have been identified in WAGO 852-303, 852-1305 and 852-1505 industrial managed ethernet switches.