238 results · Clear filters · Feed
-
High max 8.8VDE-2025-061 1 CVE
Bender Charge Controller Vulnerability - Disclosure Of Stored Credentials When Authenticated
Bender is publishing this advisory to inform customers about a security vulnerability in the Charge Controller product families. Bender has analyzed the weakness and determined that the electrical safety of the devices is not affected. Bender considers the we…
-
High max 8.3
CODESYS Control V3 - Exposed PKI folder
A vulnerability in the CODESYS Control runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorize…
first Aug 4, 2025 -
High max 7.5
TRUMPF: Remote support uses an outdated encryption algorithm
The TRUMPF remote support infrastructure selects an outdated encryption algorithm when setting up communication channels for machines. This cannot be prevented for old machines. For most machines it is possible to change the encryption settings.
first Aug 25, 2025 -
High max 8.8
Phoenix Contact: Multiple Vulnerabilities in mGuard devices
Confidential data in HTTP query string of user requests. Incomplete sanitation of user input in administrative web interface.
first Sep 10, 2024 -
High max 8.6
Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers
Start sequence for firewall service allows attack during the boot process. Password is reset to default when the device undergoes a firmware upgrade.
first Aug 13, 2024 -
High max 8.2
PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability and information disclosure
A stored cross-site scripting vulnerability has been discovered in the profinet gateway LB8122A.1.EL. An attacker can write an HTML tag with up to 32 characters in the message field of a HART transmitter. The HTML tag is interpreted as HTML when the HART info…
first May 26, 2025 -
High max 8.2
Festo: Multiple vulnerabilities in Ethernet/IP Stack of SBRD-Q/SBOC-Q/SBOI-Q
The affected product families are cameras SBOC/SBOI and the Controller SBRD. The vulnerabilities are located within the Ethernet IP Stack from EIPStackGroup OpENer Ethernet/IP.
first Sep 22, 2021 -
High max 7.8VDE-2025-063 1 CVE
Phoenix Contact: Device and Update Management Windows Installer Privilege Escalation
A privilege escalation vulnerability exists in Phoenix Contact Device and Update Management prior to version 2025.3.1 due to misconfigured permissions on nssm.exe in the DAUM-WINDOWS-SERVICE. This misconfiguration allows a low-privileged local user to execute…
-
High max 7.2VDE-2025-065 1 CVE
MB connect line: Sandbox escape in mbNET's LUA interpreter
An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in mbNET devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.
-
High max 7.2VDE-2025-069 1 CVE
Helmholz: Sandbox escape in REX200/250 LUA interpreter
An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in REX200/250 devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.
-
High max 7.5
Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function
Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service of the device.
first Sep 20, 2022 -
High max 9.8
Weidmueller: Security routers IE-SR-2TX are affected by multiple vulnerabilities
Weidmueller security routers IE-SR-2TX are affected by multiple vulnerabilities (CVE-2025-41661, CVE-2025-41663, CVE-2025-41683, CVE-2025-41684, CVE-2025-41687). Weidmueller has released new firmware versions of the affected products to fix the vulnerabilitie…
first Jun 11, 2025 -
High max 8.2VDE-2025-014 5 CVEs
Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers
Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered.
-
High max 8.8VDE-2025-040 15 CVEs
WAGO: Vulnerabilities in ctrlX OS app
The base ctrlX OS apps Device Admin and Solutions contain multiple vulnerabilities. In a worst case scenario, a remote authenticated (low-privileged) attacker might be able to execute arbitrary OS commands running with higher privileges.
-
High max 7.5
MB connect line: two vulnerabilities in mymbCONNECT24, mbCONNECT24 (Update A)
Two issues have been discovered in mymbCONNECT24 and mbCONNECT24 in all versionsincluding V2.8.0. Updated affected versions (and solution) due to incomplete fixes in previous versions
first Sep 7, 2022 -
High max 7.5
CODESYS Control V3 - OPC UA Server Authentication bypass
The OPC UA security policy Basic128Rsa15 is vulnerable against attacks on the private key. This can lead to loss of confidentiality or authentication bypass. The CODESYS OPC UA server is not affected in the default configuration. However, the affected policy …
first Mar 18, 2025 -
High max 7.8
TRUMPF: Multiple products contain vulnerable version of 7-zip
Under certain circumstances, opening a specially crafted 7-zip package can exploit an integer underflow vulnerability in 7-zip versions up to and including 22.x This vulnerability allows for a remote code execution, resulting in unauthorized (remote) access t…
first Jan 23, 2024 -
High max 7.5
Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC
Phoenix Contact classic line industrial controllers are developed and designed for the use in closed industrial networks. The controllers don't feature a function to check integrity and authenticity of the application (e.g.: logic files, executable logic, con…
first Dec 12, 2023 -
High max 8.1VDE-2025-042 2 CVEs
Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway
The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary O…
-
High max 8.8
WAGO: Multiple vulnerabilities in docker configuration
Nozomi reported eight vulnerabilities to WAGO affecting different firmwares installed on several devices.
first Nov 18, 2024 -
High max 8.8
WAGO: Multiple products prone to multiple vulnerabilities in e!Runtime / CODESYS V3 Runtime
Multiple WAGO devices are prone to vulnerabilites in the used CODESYS V3 framework.
first Jul 31, 2023 -
High max 7.8
WAGO: Multiple Products affected by Linux Kernel Vulnerability Dirty Pipe
The Linux kernel starting from 5.8 has a flaw which can lead to privilege escalation for a local user. The kernel is used in several Versions of the FW of several WAGO products. All vulnerable PLCs are listed in chapter 'Affected Products'.
first Apr 6, 2022 -
High
WAGO: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro
A vulnerability is reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations. All currently existing e!COCKPIT installation bundles and WAGO-I/O-Pro (CODESYS 2.3) installat…
first Jan 31, 2022 -
High max 7.5
WAGO: Denial of Service Vulnerability in CODESYS Runtime 2.3
A Denial-of-Service Vulnerability was reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's. All vulnerable PLCs are listed in chapter 'Affected Products'.
first Nov 16, 2021 -
High
WAGO: Multiple Vulnerabilities in I/O-Check Service
An attacker needs an authorized login on the device in order to exploit the herein mentioned vulnerabilities. The reported vulnerabilities allow a local attacker with valid login credentials who is able to create files on the device to change the devices sett…
first Mar 9, 2020 -
High
WAGO: e!Cockpit Two Update Package Vulnerabilities
The firmware update package (WUP) is not signed entirely. The used password offers no additional security, it is just meant to protect from unintentional modifications of the WUP file. Thus only the integrity of the signed firmware part (rauc file) is protect…
first Mar 9, 2020 -
High
WAGO: Multiple vulnerabilities in e!DISPLAY products
An unauthenticated user can exploit a vulnerability (CVE-2018-12981) to inject code in the WBM via reflected cross-site scripting (XSS), if he is able trick a user to open a special crafted web site. This could allow an attacker to execute code in the context…
first Jul 10, 2018 -
High
TRUMPF: Multiple products prone to X.Org server vulnerabilities
TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craf…
first Nov 7, 2022 -
High max 7.8
TRUMPF: Multiple products include a vulnerable version of Notepad++
The TRUMPF products that are listed above contain a vulnerable version of Notepad++. This version isbeing installed for support purposes only, so there is no danger of triggering this vulnerability inNotepad++ during normal operations. Nevertheless, TRUMPF re…
first Jan 23, 2024 -
High max 8.8
Pilz: Multiple products prone to libwebp vulnerability
Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the …
first Dec 5, 2023 -
High max 6.5
Phoenix Contact: PLCnext Control prone to download of code without integrity check
PLCnext Control provides authentication and integrity check for the application.An authenticated, skilled attacker might be able to manipulate the application (e.g.: logic files, executable logic, configurations) in a special crafted way that the integrity ch…
first Dec 12, 2023 -
High max 8.8
Phoenix Contact: PLCnext prone to Incorrect Permission Assignment for Critical Resource
PLCnext Control provides authentication and integrity check for the application.An authenticated, skilled attacker might be able to manipulate the application (e.g.: logic files, executable logic, configurations) in a special crafted way that the integrity ch…
first Dec 12, 2023 -
High max 7.5
Phoenix Contact: ProConOS prone to Download of Code Without Integrity Check
Increased Security attacks against OT infrastructure and research of Dragos makes it necessary to publish this advisory giving users hints according to basic security measures to support automation systems using existing devices based on ProConOS/ProConOS eCL…
first Dec 12, 2023 -
High max 7.5
PHOENIX CONTACT: Denial-of-Service vulnerability in mGuard product family
A denial of service of the HTTPS management interface of PHOENIX CONTACT FL MGUARD and TC MGUARD devices can be triggered by a larger number of unauthenticated HTTPS connections originating from different source IP's. Configuring firewall limits for incoming …
first Nov 15, 2022 -
High max 7.8
PHOENIX CONTACT: PC Worx/-Express prone to improper input validation vulnerability
PC Worx / -Express is vulnerable to a 'zip slip' style vulnerability when loading a project file.
first Nov 3, 2021 -
High
PHOENIX CONTACT: Local Privilege Escalation in PC WORX SRT
The Phoenix Contact application 'PC WORX SRT' is installed as service. The installation path of the application is configured to have insecure permissions which allows any unprivileged user to write arbitrary files to the installation directory where all the …
first Mar 27, 2020 -
High max 7.5
PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management
Access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.
first Aug 11, 2021 -
High
PHOENIX CONTACT: improper access control exists on FL NAT devices when using MAC-based port security
If MAC-based port security or 802.1x port security is enabled, the FL NAT 2xxx will unintentionally grant access to unauthorized devices in case of routed transmission. ''' Subnet 2---(Ports belonging to subnet 2) | FL NAT 2xxx | (Ports belonging to subnet 1,…
first Oct 29, 2019 -
High
Pepperl+Fuchs, PACTware: Two password vulnerabilities found
PACTware passwords are stored in a recoverable format (CVE-2020-9403) PACTware passwords may be modified without knowing the current password (CVE-2020-9404)
first May 29, 2020 -
High
Pepperl+Fuchs: RSM-EX devices - Multiple Bluetooth vulnerabilities
Critical vulnerabilities have been discovered in the utilized Bluetooth component. For more information see: https://kb.cert.org/vuls/id/799380
first May 16, 2022