541 results · Feed
-
Critical max 9.1
Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual
Multiple vulnerabilities have been discovered in Helmholz myREX24V2/myREX24V2.virtual that could allow RCE, SQLi or information leakage.
first Apr 13, 2026 -
Medium max 6.9
CODESYS Visualization - Insufficiently Protected Credentials
A vulnerability in the CODESYS Visualization login dialog has been identified. During logins within the CODESYS Visualization, authentication data may not be sufficiently isolated when multiple users perform login operations concurrently. As a result, an auth…
-
High max 6.5
Pepperl+Fuchs: ICE2- * and ICE3- * are affected by multiple vulnerabilities
Critical vulnerabilities have been discovered in the product due to outdated software components.The impact of the vulnerabilities on the affected device may result in Denial of service Bypassing of authentication Information disclosure
first Apr 10, 2024 -
Medium max 8.2
CODESYS Modbus TCP Server - Improper resource management
CODESYS Modbus is an add‑on for the CODESYS Development System that provides a fully integrated Modbus protocol stack along with diagnostic capabilities. A flaw in the CODESYS Modbus TCP Server protocol stack library results in a vulnerability. When a Modbus …
-
High max 8.3VDE-2026-005 3 CVEs
ifm: Multiple Vulnerabilities in CR3171
The Firmware installed on the CR3171 is impacted by various CODESYS vulnerabilities.
-
High max 7.5PPSA-2026-002 1 CVE
Pilz: Vulnerability affecting PASvisu Runtime
The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by malicious web requests.
-
Medium max 8.8VDE-2026-029 1 CVE
METTLER TOLEDO: OpenSSL vulnerability in MX and MR balances
MX/MR firmware V2.0.0 or earlier is affected by the OpenSSL vulnerability CVE-2025-15467.
-
High max 8.8VDE-2026-023 2 CVEs
Phoenix Contact: Several products are affected by vulnerabilities found in OpenSSL
Attacks are possible when installing key files and digitally signed objects. These attacks can only be carried out if these files are uploaded and installed by a logged-in user with high privileges.
-
High max 7.5
Helmholz: Use of a Broken or Risky Cryptographic Algorithm
Vulnerabilities in WALL IE devices with firmware <= V1.10.210 that allow an attacker to gain control over the device.
-
Critical max 9.3
Endress+Hauser: sudo vulnerability affects Endress+Hauser MCS200HW
The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.
-
High max 7.2VDE-2024-008 1 CVE
Wago: Vulnerability in WBM through Open VPN
A security vulnerability has been identified in the Web-Based Management (WBM) function when OpenVPN is enabled.
-
High max 7.5VDE-2026-013 1 CVE
Helmholz: Use of a Broken or Risky Cryptographic Algorithm
Vulnerabilities in PROFINET-Switch devices with firmware <= V1.12.010 that allow an attacker to gain control over the device.
-
Critical max 9.1VDE-2026-030 5 CVEs
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow RCE, SQLi or information leakage.
-
High max 9.8
Endress+Hauser: Multiple products affected by Qualcomm vulnerabilities
Multiple vulnerabilities in a Qualcomm component have been reported in a closed-source report. This component is an integral part of the radio chip found in several Endress+Hauser products.
first Dec 5, 2025 -
High max 7.9VDE-2025-098 1 CVE
Baade M2M-Products GmbH: ubusd heap buffer overflow vulnerability in OpenWRT prior to version 24.10.4
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code i…
-
High max 8.8
Endress+Hauser: Multiple products prone to multiple vulnerabilities in e!Runtime and CODESYS V3 Runtime
Multiple Endress+Hauser devices are prone to vulnerabilities found in e!Runtime and the CODESYS V3 framework.
first Mar 31, 2026 -
Critical max 8.6VDE-2026-021 45 CVEs
WAGO: Multiple Vulnerabilities in WAGO VC Hub
The VC Hub incorporates the Magick.NET‑Q16‑AnyCPU component, derived from ImageMagick, to process user‑uploaded images and generate thumbnails within the projects image library. Only authenticated users with the Design Project Permission can upload images.
-
Critical max 9.9VDE-2026-010 2 CVEs
WAGO: Multiple Vulnerabilities in WAGO Solution Builder and WAGO Device Sphere
Multiple vulnerabilities have been identified in WAGO Solution Builder and WAGO Device Sphere that affect components responsible for authentication and system communication.
-
Critical max 9.8VDE-2026-024 2 CVEs
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
-
Critical max 9.8VDE-2026-025 2 CVEs
Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual
Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.
-
Critical max 10.0VDE-2026-020 1 CVE
WAGO: Vulnerability in managed switches
A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
-
High max 7.2VDE-2025-104 8 CVEs
Phoenix Contact: Multiple Vulnerabilities in FL SWITCH 2xxx, FL SWITCH TSN 23xx and FL SWITCH 59xx Firmware
Multiple vulnerabilities have been identified in the FL SWITCH 2xxx, FL SWITCH TSN 23xx and FL SWITCH 59xx firmware prior to version 3.53. One of these (CVE-2026-22317) enables an attacker to execute system commands as root user on the device. Five other vuln…
-
High max 7.3
CODESYS Installer - Possible Privilege Escalation
The CODESYS Installer is affected by a privilege escalation vulnerability. Due to a race condition, a local attacker with limited privileges can replace the verified downloaded setup before execution. Because the update process runs with administrator privile…
-
High max 9.8VDE-2025-096 4 CVEs
Weidmueller: Multiple vulnerabilities in Energy Meter 750-24 and Energy Meter 750-230
An unauthenticated remote attacker can exploit several vulnerabilities in Weidmueller devices Energy Meter 750-24 and Energy Meter 750-230 to ultimately gain full system access and remote code execution.
-
Critical max 9.8VDE-2025-079 4 CVEs
Janitza: Multiple vulnerabilities in UMG 96RM-E
An unauthenticated remote attacker can exploit several vulnerabilities in Janitza UMG 96RM-E devices to ultimately gain full system access and remote code execution.
-
Critical max 9.8
MB connect line: Multiple Vulnerabilities in MB connect line Products
Multiple vulnerabilities have been discovered in MB connect line products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the mbCONNECT24 and mymbCONNECT24 products. CVE-2024-45273 affects the mbNET/mbNET.rokey, mbCONNECT24, mymbCONNE…
first Oct 15, 2024 -
Critical max 9.8
Helmholz: Multiple Vulnerabilities in Helmholz products
Multiple vulnerabilities have been discovered in Helmholz products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the myREX24V2 and myREX24V2.virtual products. CVE-2024-45273 affects the REX 200/REX 250, myREX24V2, myREX24V2.virtual …
first Oct 15, 2024 -
Critical max 9.9VDE-2026-001 1 CVE
METTLER TOLEDO: ASP.NET core vulnerability in LabX
LabX 21.2.12 (formerly known as LabX Cloud 1.2.12) is affected by the ASP.NET core vulnerability CVE-2025-55315.
-
Critical max 9.8
Carlo Gavazzi Controls: Multiple Vulnerabilities in Controller UWP 3.0
The UWP 3.0 family of Monitoring Gateways and Controllers and the CPY Car Park Server are affected by multiple vulnerabilities in their set-up software, runtime firmware, embedded Web interface.
first Sep 26, 2022 -
High max 7.8
Endress+Hauser: buffer overflow in glibc ld.so leading to privilege escalation
A vulnerability has been identified in WAGO devices utilized in Endress+Hauser IoT solutions. WAGO has provided fixes for these vulnerabilities, which have been integrated into the solutions by Endress+Hauser.
-
Critical max 9.8
Several CODESYS vulnerabilities in Festo Automation Suite
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwar…
-
Medium max 5.9
Phoenix Contact: Unbounded growth of the session cache in TCP encapsulation service in FL MGUARD 2xxx and 4xxx firmware
The OpenSSL library used in the affected products is vulnerable to an unbounded growth of the session cache in the TLSv1.3 implementation.
first Feb 10, 2026 -
High max 8.2VDE-2026-007 1 CVE
TRUMPF: Multiple products affected by Wibu CodeMeter vulnerability
The TRUMPF product versions listed below include a Wibu CodeMeter component that is vulnerable to a privilege escalation vulnerability through the CodeMeter installer on Windows.
-
Medium max 7.4
Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions
A privilege escalation vulnerability has been identified in Endress+Hauser's Proline 10 devices. This flaw allows an authenticated user with Operator-level access to elevate their privileges and gain Maintenance-level access, potentially enabling unauthorized…
first Sep 2, 2025 -
High max 7.5
ifm: Improper Access Control vulnerability
A vulnerability has been disclosed in PLC ifm AC4xxS that allows an attacker to trigger the safety state with the help of a specially crafted html request. This leads to a loss of availability.
first Jun 30, 2025 -
MediumHBSA-2025-0003 0 CVEs
JBL: DoS vulnerability in Flip 4
The Bluetooth Classic implementation on JBL Flip 4 devices with firmware version prior to 4.1.0 does not properly handle malformed LMP messages and causes the entire device to crash. Any attacker in radio range can exploit this vulnerability.
-
High max 7.5
CODESYS Control - Invalid type usage in visualization
A vulnerability in the CODESYS Control runtime system's CmpVisuServer component allows attackers to cause a denial-of-service (DoS) by sending special request to the CODESYS Web- or remote Target Visu. The issue is triggered by an internal read access using a…
first Dec 1, 2025 -
Medium max 5.9
CODESYS Control - Linux/QNX SysSocket flaw
A vulnerability has been identified in the CODESYS Control runtime system, which includes an abstraction layer designed to ensure compatibility across different operating systems. This layer is used both by affected CODESYS products and by applications runnin…
first Dec 1, 2025 -
Medium max 5.5
Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
An optional package of the TwinCAT 3 XAR installs the TwinCAT 3 HMI Server on a device. It provides a server configuration page which can be accessed by administrative users only. When such an administrator accesses the server configuration page it is possibl…
first Jan 26, 2026 -
High max 9.8VDE-2026-004 4 CVEs
WAGO: Vulnerabilities in Managed Switch
Several vulnerabilities have been identified in the WAGO 852‑1328 device's web‑based management interface, which is implemented using a modified lighttpd server and custom CGI binaries. These issues include multiple stack buffer overflows, an authentication b…