29 results · Clear filters · Feed
-
Medium max 9.2
Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT affected by PHP vulnerability
The Weidmueller security routers IE-SR-4TX and IE-SR-4GT in firmware releases prior to 2.3.4 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability can allow an attacker to cause a denial of serv…
-
Critical max 9.2
MB connect line: php2shell in mbCONNECT24/mymbCONNECT24
MB connect line mbCONNECT24/mymbCONNECT24 ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
Critical max 9.2
Helmholz: php2shell in myREX24V2/myREX24V2.virtual
Helmholz myREX24V2/myREX24V2.virtual ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
Critical max 9.8
Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG)
Bender is publishing this advisory to inform customers about two vulnerabilities in the Linux kernel used by the EDGE500IP. CISA has added both vulnerabilities (CVE-2025-39682 and CVE-2025-39964) to its Known Exploited Vulnerabilities catalog. Bender has anal…
-
Medium max 9.2
ads-tec Industrial IT: PHP Vulnerability in ADS-TEC IRF Products and Web Terminals
The ADS-TEC IRF1000 and IRF3000 products in firmware releases prior to 2.3.3, the IRF2000 products in firmware releases prior to 5.0.12 and the ADS-TEC web terminals DVG-SHW9019, DVG-SHW9024, DVG-MEW9016, DVG-MEW9019, DVG-MEW9024, DVG-OPW9016, DVG-OPW9019 and…
-
Critical max 9.2
Two critical PHP vulnerabilities in several Festo Didactic products
Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vu…
first Nov 2, 2026 -
Critical max 9.2
WAGO: Multiple Devices affected by PHP2Shell
Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpect…
first Nov 2, 2026 -
Critical max 9.2
Welotec: PHP2Shell Vulnerabilities in SMART EMS
Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability…
-
Critical max 9.2
METTLER TOLEDO: PHP2Shell in Octo Image Server
OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.
-
High max 8.8
Pilz: Multiple Vulnerabilities affecting industrial PC IndustrialPI
The Linux kernel used in the IndustrialPI, 'linux-image-revpi-v8', prior to version 6.12.91-revpi0-rpi-v8 contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can give an attacker full control over the device.
-
Critical max 9.3
Endress+Hauser: sudo vulnerability affects Endress+Hauser MCS200HW
The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.
-
High max 7.8
Endress+Hauser: buffer overflow in glibc ld.so leading to privilege escalation
A vulnerability has been identified in WAGO devices utilized in Endress+Hauser IoT solutions. WAGO has provided fixes for these vulnerabilities, which have been integrated into the solutions by Endress+Hauser.
-
Critical max 9.8
Several CODESYS vulnerabilities in Festo Automation Suite
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwar…
-
High max 7.8
TRUMPF Laser GmbH: TruControl 2.14.0 to 3.14.0 affected by recent sudo vulnerability
TruControl laser control software from versions 2.14.0 to 3.14.0 use sudo versions affected by CVE-2021-3156. The affected sudo has a heap-based buffer overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends wit…
first Mar 22, 2021 -
Critical max 9.8
Festo: Several vulnerabilities in FactoryViews
FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of Facto…
first Jul 10, 2023 -
Critical max 9.8
Several Vulnerabilities in MES PC (Windows 10)
MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. …
first Feb 27, 2024 -
Critical max 9.3
WAGO: Critical sudo Vulnerability in Multiple Products
A vulnerability in sudo allows a low privileged attacker to execute commands with root rights.
-
High max 7.8
WAGO: Multiple Products affected by Linux Kernel Vulnerability Dirty Pipe
The Linux kernel starting from 5.8 has a flaw which can lead to privilege escalation for a local user. The kernel is used in several Versions of the FW of several WAGO products. All vulnerable PLCs are listed in chapter 'Affected Products'.
first Apr 6, 2022 -
Critical max 10.0
WAGO: Smart Script affected by Log4Shell Vulnerability
Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers …
first Jan 5, 2022 -
High max 8.8
Pilz: Multiple products prone to libwebp vulnerability
Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the …
first Dec 5, 2023 -
Critical max 8.8
Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2024.0.6 LTS
first Dec 9, 2024 -
Critical max 9.8
Pepperl+Fuchs: Multiple VDM100-Distance Ethernet-IP sensors with multiple vulnerabilities
Critical vulnerabilities have been discovered in the utilized component TRECK TCP/IP Stack by Digi International Inc. For more information see advisory by Digi International Inc.: Digi International Security Notice - TRECK TCP/IP Stack "RIPPLE20" VU#257161 IC…
first Aug 16, 2021 -
Critical max 9.8
Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service
Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1. The impact of the vulnerabilities on the affected device may result in - denial of service - remote code execution - cod…
first Oct 16, 2021 -
Critical max 9.8
Miele: Treck TCP/IP Vulnerabilities (Ripple20) affecting Communication Module XKM3000 L MED
For process data documentation purposes the laboratory washers, thermal disinfectors and washer-disinfectors can be integrated in a TCP/IP network by utilizing the affected communication module. The communication module is separate from the actual device cont…
first Jul 8, 2020 -
High max 7.8
Multiple TRUMPF products prone to nftables server vulnerabilities
TruControl laser control software from versions 3.50.0 to 4.00.0.B use Linux kernel versions affected by CVE-2024-1086. The affected kernel vulnerability could lead to local privilege escalation.
first Jun 25, 2024 -
High max 7.8
Pepperl+Fuchs: Use after free vulnerability in Smart-Ex 02 and Smart-Ex 03
A critical security vulnerability was discovered in the products, which is caused by the IPv6 stack in the Linux kernel.The impact of the vulnerability on the affected products may result in Elevation of privileges
-
High max 8.8
Pilz: Electron Vulnerabilities in PASvisu and PMI v8xx
The Builder and Viewer components of the product PASvisu are based on the 3rd-party-component Electron. Electron contains several other open-source components which are affected by vulnerabilities. The vulnerabilities may enable an attacker to gain full contr…
-
High max 8.8
Pepperl+Fuchs: Security Advisory for PrintNightmare Vulnerability in multiple HMI Devices
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could th…
-
Critical max 9.8
Pepperl+Fuchs: Remote code execution vulnerability in HMI devices
A remote code execution vulnerability exists in **Remote Desktop Services** – formerly known as **Terminal Services** – when an unauthenticated attacker connects to the target system using **RDP** and sends specially crafted requests. This vulnerability is **…
first May 29, 2019