238 results · Clear filters · Feed
-
High max 7.5
WAGO: OpenSSL DoS Vulnerability in PLCs
WAGO controllers have always been designed for easy connection to IT infrastructure. Even controllers from legacy product lines support encryption standards to ensure secure communication. With special crafted requests it is possible to bring the device out o…
first Aug 31, 2021 -
High max 8.6
Pepperl+Fuchs: Multiple Products - Vulnerability may allow remote attackers to cause a Denial Of Service
Critical vulnerability has been discovered in the utilized component Ethernet IP Stack by Hilscher Gesellschaft für Systemautomation mbH. The impact of the vulnerability on the affected device is that it can denial of service remote code execution code exposu…
first Feb 16, 2021 -
High max 7.8
Wiesemann & Theis: Multiple products prone to unquoted search path
Multiple Wiesemann & Theis software products are affected by a vulnerability through an unquoted search path in the Windows registry. A local attacker can execute arbitrary code and gain administrative privileges by inserting an executable file in the path of…
first Feb 28, 2024 -
High max 7.3
Weidmueller: WI Manager affected by fdtContainer vulnerability
A vulnerability has been discovered in the fdtCONTAINER component and application by M&M Software GmbH. As this software is part of the Weidmüller FDT/DTM Software with WI Manager, this Weidmueller software is affected by the above vulnerability as well. The …
first Jan 20, 2021 -
High max 7.5
WAGO: Vulnerabilities in CODESYS Control V3 - OPC UA Stack
Several WAGO Firmwares are vulnerable to an incorrect calculation of the buffer size in the CODESYS OPC UA STACK. This can lead to a crash of the runtime of the affected firmware versions installed on several devices.
first Feb 4, 2025 -
High
WAGO: Web-Based Management Authentication Vulnerabilities
With special crafted requests it is possible to get sensitive information, in this case the password hashes, by measuring response delay. With a substantial amount of time this data can be used to calculate the passwords of the Web-Based Management users. In …
first Mar 9, 2020 -
High max 8.2
WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07
The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates. With special crafted requests it is possible to change some special parameters without authentication.
first Sep 30, 2020 -
High max 7.5
Phoenix Contact: Security Advisory for AXL F BK and IL BK bus couplers
A denial of service (DoS) attack targeting port 80 (http service) can overload the device (CWE-770). This behaviour has been observed when running network security scanners.
first May 13, 2025 -
High
PHOENIX CONTACT: Advisory for mGuard products
The integrity of the mGuard firmware atomic update process cannot be guaranteed under all circumstances. The mGuard atomic update mechanism relies on internal checksums for the integrity verification of some portions of the update packages. The verification o…
first Jan 30, 2018 -
High max 7.5
PHOENIX CONTACT: DoS for PLCnext Control devices in versions <2021.0.5 LTS
A device on the same network as the controller sending a special crafted JSON request to the /auth/access-token endpoint may cause the controller to restart (CWE-20). UPDATE A The CVSS score has been raised from 7.7 (CVSS:3.0:AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A…
first Aug 4, 2021 -
High max 7.4
PHOENIX CONTACT: Security Advisory for PLCNext, ILC 2050 BI, FL MGUARD DM UNLIMITED, TC ROUTER und CLOUD CLIENT products
A Denial of Service and a CA Check Problem have been identified in multiple openSSL 1.1.1 versions, which are utilized in the Phoenix Contact products listed above.
first Jun 23, 2021 -
High max 7.5
PHOENIX CONTACT: Security Advisory for FL SWITCH SMCS series
Multiple vulnerabilities have been discovered in the current firmware of the PHOENIX CONTACT FL SWITCH SMCS series switches.
first Jun 23, 2021 -
High max 7.5
PHOENIX CONTACT: Security Advisory for FL COMSERVER UNI
When the communication partner sends an invalid Modbus exception response to the FL COMSERVER UNI as a query, the Modbus communication stops, and the device will be unresponsive for some minutes before the functionality is fully restored (CWE-772).
first Jun 23, 2021 -
High max 7.8
PHOENIX CONTACT: Security Advisory for Automation Worx Software Suite
Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data (CWE-824). The attacker needs to get access to an original bus configuration file (*.bcp) to be able to man…
first Jun 23, 2021 -
High max 7.5
PHOENIX CONTACT: BTP Touch Panels uncontrolled resource consumption
Uncontrolled Resource Consumption can be exploited to cause the HMI to become unresponsive and not accurately update the display content (Denial of Service).
first Dec 2, 2020 -
High max 8.2
PHOENIX CONTACT: Improper path sanitation on import of project files in PLCnext Engineer
The build settings of a PLCnext Engineer project (.pcwex) can be manipulated in a way that can result in the execution of remote code. The attacker needs to get access to a PLCnext Engineer project to be able to manipulate files inside. Additionally, the file…
first Jul 21, 2020 -
High max 7.8
PHOENIX CONTACT: Two Vulnerabilities in Automation Worx Suite
Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation. The attacker needs to get access to an original PC Worx project to be able to manipulate data inside the project folder. After manipulation the attac…
first Jul 1, 2020 -
High max 8.8
PHOENIX CONTACT: TC Router and TC Cloud Client multiple vulnerabilities
Multiple Vulnerabilities exist in components used by the aforementioned products. See CVE-Details for more information.
first Mar 5, 2020 -
High
PHOENIX CONTACT: Security Advisory for Automation Worx Software Suite
Manipulated PC Worx or Config+ projects could lead to a remote code execution due to insufficient input data validation. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside the project folder. After …
first Oct 15, 2019 -
High
PHOENIX CONTACT: Multiple Vulnerabilities in Automation Worx Software Suite
A manipulated PC Worx or Config+ project file could lead to a remote code execution.\ The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation the attacker needs to exchange the original f…
first Jun 19, 2019 -
High
PHOENIX CONTACT: unauthorized access to WEB-UI on FL NAT SMx
After login the source IP is used as the session identifier, so that users sharing the same source IP are able to gain full authenticated access to the WEB-UI. The access attempt will only be successful if the former authorized session has not been terminated…
first Mar 25, 2019 -
High
PHOENIX CONTACT: command injection on RAD-80211-XD(/HP-BUS)
A WebHMI utility may be exploited by any logged in user allowing the execution of arbitrary OS commands on the server. This provides the opportunity for a command injection attack.
first Mar 25, 2019 -
High max 8.1
PEPPERL+FUCHS: Multiple products are affected by regreSSHion
The affected devices run a SSH server that is affected by the regreSSHion vulnerability despite the fact that no user can actually log in through SSH. Attackers may exploit this vulnerability to gain root access to the device.
first Oct 8, 2024 -
High max 7.3
Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.31
A critical vulnerability has been discovered in the fdtCONTAINER component by M&M Software GmbH used by PACTware. While de-serializing PACTware 5 project files (loading PW5 files) the vulnerability can be exploited to execute arbitrary code.
first Jan 15, 2021 -
High max 7.5
MB connect line: Remote user enumeration in mbCONNECT24/mymbCONNECT24
An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.9.0.
first Oct 27, 2021 -
High max 8.1
Helmholz: Multiple products are vulnerable to regreSSHion
Several Helmholz products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".
first Jul 31, 2024 -
High max 9.1
Endress+Hauser: Ecograph T utilizing Webserver firmware version 1.x suffers from improper privilege management
The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens".
first Nov 19, 2020 -
High max 7.8
Multiple TRUMPF products prone to nftables server vulnerabilities
TruControl laser control software from versions 3.50.0 to 4.00.0.B use Linux kernel versions affected by CVE-2024-1086. The affected kernel vulnerability could lead to local privilege escalation.
first Jun 25, 2024 -
High max 8.1
Multiple TRUMPF products prone to regreSSHion OpenSSH server vulnerabilities
TruControl laser control software prior to version 1.60.0 uses an OpenSSH server version affected by CVE-2024-6387. The affected OpenSSH Server version could potentially lead to a remote code execution.
first Jun 25, 2024 -
High max 8.1
Pilz: Vulnerability in PASvisu and PMI v8xx
Multiple Pilz products are affected by stored cross-site-scripting (XSS) vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system. Update: 27.02.2024 Fix typo in advisory title
first Jan 30, 2024 -
High max 7.5
CODESYS: CODESYS web server vulnerable to DoS
The CODESYS web server component of the CODESYS Control runtime system is used by the CODESYS WebVisu to display visualization screens in a web browser. Receiving a specifically crafted TLS packet on an HTTPS connection causes the CODESYS web server to crash …
first Sep 25, 2024 -
High max 7.8
Lenze: Install Directory with insufficient permissions
The following tools: * VisiWinNET Smart * VisiWinNET Professional * EASY UI Designer create a directory with insufficient permissions, allowing a low-level user the ability to add and modify certain files that hold SYSTEM privileges, which could lead to privi…
first Sep 3, 2024 -
High max 8.6VDE-2025-036 19 CVEs
Multiple vulnerabilities in Endress+Hauser MEAC300-FNADE4
Several vulnerabilities in the Endress+Hauser MEAC300-FNADE4 were discovered, that can be accessed via Ethernet.
-
High max 8.8
SMA: Cluster Controller CSRF vulnerability
A security researcher discovered a Cross Site Request Forgery (CSRF, XSRF) vulnerability in SMA Cluster Controller. The affected products are out of support (End-of-Life 2018-06-30).
first Jan 27, 2025 -
High max 7.5VDE-2024-072 1 CVE
WAGO: Vulnerabilities in CODESYS Control
The following firmware versions installed on several devices are vulnerable due to a vulnerability in the CODESYS Control V3 web server.
-
High max 8.1VDE-2024-043 1 CVE
Welotec: Multiple products are vulnerable to regreSSHion
Products from the Edge Gateway Family are affected by recently published so called RegreSSHion vulnerability.
-
High max 7.8
Pepperl+Fuchs: Use after free vulnerability in Smart-Ex 02 and Smart-Ex 03
A critical security vulnerability was discovered in the products, which is caused by the IPv6 stack in the Linux kernel.The impact of the vulnerability on the affected products may result in Elevation of privileges
-
High max 7.2
Helmholz: REX 100 vulnerable to OS command injection
There exists a vulnerability in all REX 100 devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30pm In section Reported by Sebastian Dietz (CyberDanube) was added.
-
High max 7.2VDE-2024-030 1 CVE
MB connect line: mbNET.mini vulnerable to OS command injection
There exists a vulnerability in all mbNET.mini devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30 pm In section Reported by Sebastian Dietz (CyberDanube) was ad…
-
High max 7.3VDE-2023-068 17 CVEs
WAGO: Multiple Vulnerabilities in e!Cockpit and e!Runtime / CODESYS Runtime
The following vulnerabilities are published with reference to CODESYS Advisory 2023-05, CODESYS Advisory 2023-06 and CODESYS Advisory 2023-09