541 results · Feed
-
Critical max 10.0PPSA-2025-002 1 CVE
Pilz: Missing Authentication in Node-RED integration
Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run arbitrary operating system commands on the underlying operating s…
-
Critical max 9.8PPSA-2025-001 3 CVEs
Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory
PiCtory, a web application to configure the Pilz industrial PC IndustrialPI, has three vulnerabilities with varying degrees of severity. The first two are of critical severity and can lead to a bypass of authentication and a cross-site-scripting attack. The t…
-
Medium max 5.5VDE-2025-043 1 CVE
Lenze: PLC Designer V4 with insecure storage of sensitive information
A security vulnerability was discovered in the PLC Designer V4 in the version 4.0.0 where the programmer of a Controller can set a password for the connected device. Here it is possible in an interface of the PLC Designer V4 for the programmer to enter a pass…
-
Critical max 8.2VDE-2025-034 1 CVE
Vulnerabilities in mbCONNECT24/mymbCONNECT24
The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.
-
Critical max 7.5VDE-2025-035 2 CVEs
Vulnerabilities in mbCONNECT24/mymbCONNECT24
Two vulnerabilities in mbCONNECT24/mymbCONNECT24 can lead to user enumeration an password bypass.
-
Critical max 8.2VDE-2025-037 1 CVE
Vulnerabilities in myREX24/myREX24.virtual
The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.
-
Critical max 7.5VDE-2025-038 2 CVEs
Vulnerabilities in myREX24/myREX24.virtual
Two vulnerabilities in myREX24/myREX24.virtual can lead to user enumeration an password bypass.
-
Critical max 9.8
Festo: CECC-X-M1 - command injection vulnerabilities
The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability. Update A, 2022-07-05 Remediation has been updated. Fixed firmwares are now available.
first Jul 6, 2022 -
Medium max 6.4
SMA: Sunny Webbox clickjacking vulnerability
A security researcher discovered that in the affected products a clickjacking vulnerability in the web frontend exists. An attacker could lure the user to click on a malicious website which seems to be the WebUI of the affected product. The affected products …
first Jan 27, 2025 -
High max 8.8VDE-2025-040 15 CVEs
WAGO: Vulnerabilities in ctrlX OS app
The base ctrlX OS apps Device Admin and Solutions contain multiple vulnerabilities. In a worst case scenario, a remote authenticated (low-privileged) attacker might be able to execute arbitrary OS commands running with higher privileges.
-
Low max 4.3VDE-2025-047 1 CVE
AUMA: Incorrect delivery status of the Bluetooth configuration
For actuators with AC.2 controls and PROFOX actuators, a wrong configuration occurred for deliveries within the period from 01.01.2024 to 09.05.2025. Despite the ordered option "L90.00 = Bluetooth always deactivated", these actuators were delivered with an ac…
-
High max 7.5
MB connect line: two vulnerabilities in mymbCONNECT24, mbCONNECT24 (Update A)
Two issues have been discovered in mymbCONNECT24 and mbCONNECT24 in all versionsincluding V2.8.0. Updated affected versions (and solution) due to incomplete fixes in previous versions
first Sep 7, 2022 -
Medium max 5.3
CODESYS (Edge) Gateway for Windows insecure default
The CODESYS Gateway enables communication between CODESYS runtimes and other clients, primarily the CODESYS Development System V3. It is usually installed as a part of the CODESYS Development System V3 setup and accessed locally by the CODESYS Development Sys…
first Mar 18, 2025 -
High max 7.5
CODESYS Control V3 - OPC UA Server Authentication bypass
The OPC UA security policy Basic128Rsa15 is vulnerable against attacks on the private key. This can lead to loss of confidentiality or authentication bypass. The CODESYS OPC UA server is not affected in the default configuration. However, the affected policy …
first Mar 18, 2025 -
Medium max 6.6
CODESYS Control V3 removable media path traversal
A low privileged attacker with physical access to a controller, that supports removable media and is running a CODESYS Control runtime system, can exploit the insufficient path validation by connecting removable media with a file system supporting symbolic li…
first Mar 18, 2025 -
Medium max 4.2
CODESYS Key physical side-channel vulnerability
The CODESYS Key USB dongle, which is based on WIBU CodeMeter technology, is affected by a physical side-channel vulnerability.
first Jan 21, 2025 -
Medium max 5.9
WAGO: Multiple products affected by Terrapin
Several WAGO Firmwares are vulnerable to a to a remote attack which allows to bypass the integrity check through OpenSSH. This called Terrapin attack occurs because of mishandled handshake phase.
first Feb 22, 2024 -
Medium max 5.5
Pilz: Multiple products affected by ZipSlip
Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.
first Nov 24, 2022 -
Medium
BECKHOFF: Null Pointer Dereference vulnerability in products with OPC UA technology
By tricking clients of the mentioned products into contacting malicious OPC UA servers and thereby acting as OPC UA clients, a crash of the component can be provoked.
first Mar 1, 2022 -
High max 7.8
TRUMPF: Multiple products contain vulnerable version of 7-zip
Under certain circumstances, opening a specially crafted 7-zip package can exploit an integer underflow vulnerability in 7-zip versions up to and including 22.x This vulnerability allows for a remote code execution, resulting in unauthorized (remote) access t…
first Jan 23, 2024 -
High max 7.5
Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC
Phoenix Contact classic line industrial controllers are developed and designed for the use in closed industrial networks. The controllers don't feature a function to check integrity and authenticity of the application (e.g.: logic files, executable logic, con…
first Dec 12, 2023 -
Critical max 9.8
PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware
A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM …
first Feb 14, 2023 -
Critical
PHOENIX CONTACT: Advisory for multiple FL Switch GHS utilising VxWorks
CVS-2019-12255 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow. The vulnerability affects a little-known feature of the TCP/IP pro…
first Feb 25, 2020 -
Medium max 4.3VDE-2025-020 1 CVE
WAGO: Switches affected by year 2k38 problem
The Year 2038 Problem affects systems using a 32-bit integer to represent time as the number of seconds since January 1st, 1970. On January 19, 2038, at 03:14:07 UTC, the time value will exceed the maximum for a 32-bit integer, causing an overflow and resetti…
-
High max 8.1VDE-2025-042 2 CVEs
Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway
The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary O…
-
Critical max 9.8
Weidmueller: WIBU Vulnerability in multiple Products
Multiple Weidmueller products are affected by recent WIBU vulnerability.
first Nov 9, 2023 -
Critical max 9.8
Weidmueller: multiple vulnerabilities in various Industrial Ethernet managed switches
Multiple issues have been found. Please check the CVEs for details.
first Dec 5, 2019 -
High max 8.8
WAGO: Multiple vulnerabilities in docker configuration
Nozomi reported eight vulnerabilities to WAGO affecting different firmwares installed on several devices.
first Nov 18, 2024 -
High max 8.8
WAGO: Multiple products prone to multiple vulnerabilities in e!Runtime / CODESYS V3 Runtime
Multiple WAGO devices are prone to vulnerabilites in the used CODESYS V3 framework.
first Jul 31, 2023 -
Critical max 9.8
WAGO: Unauthenticated command execution via Web-based-management UPDATE A
The 'legal information' plugin of web-based-management contained a vulnerability which allowed execution of arbitrary commands with privileges of www user. UPDATE A 15.06.2023 : Removed PFC100 with FW23 as affected product and from solution PFC200 with FW23 i…
first May 15, 2023 -
High max 7.8
WAGO: Multiple Products affected by Linux Kernel Vulnerability Dirty Pipe
The Linux kernel starting from 5.8 has a flaw which can lead to privilege escalation for a local user. The kernel is used in several Versions of the FW of several WAGO products. All vulnerable PLCs are listed in chapter 'Affected Products'.
first Apr 6, 2022 -
High
WAGO: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro
A vulnerability is reported in WIBU-SYSTEMS Codemeter. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations. All currently existing e!COCKPIT installation bundles and WAGO-I/O-Pro (CODESYS 2.3) installat…
first Jan 31, 2022 -
Critical max 10.0
WAGO: Smart Script affected by Log4Shell Vulnerability
Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers …
first Jan 5, 2022 -
High max 7.5
WAGO: Denial of Service Vulnerability in CODESYS Runtime 2.3
A Denial-of-Service Vulnerability was reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's. All vulnerable PLCs are listed in chapter 'Affected Products'.
first Nov 16, 2021 -
Critical max 9.1
WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3
Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's.
first May 20, 2021 -
High
WAGO: Multiple Vulnerabilities in I/O-Check Service
An attacker needs an authorized login on the device in order to exploit the herein mentioned vulnerabilities. The reported vulnerabilities allow a local attacker with valid login credentials who is able to create files on the device to change the devices sett…
first Mar 9, 2020 -
High
WAGO: e!Cockpit Two Update Package Vulnerabilities
The firmware update package (WUP) is not signed entirely. The used password offers no additional security, it is just meant to protect from unintentional modifications of the WUP file. Thus only the integrity of the signed firmware part (rauc file) is protect…
first Mar 9, 2020 -
High
WAGO: Multiple vulnerabilities in e!DISPLAY products
An unauthenticated user can exploit a vulnerability (CVE-2018-12981) to inject code in the WBM via reflected cross-site scripting (XSS), if he is able trick a user to open a special crafted web site. This could allow an attacker to execute code in the context…
first Jul 10, 2018 -
High
TRUMPF: Multiple products prone to X.Org server vulnerabilities
TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craf…
first Nov 7, 2022 -
Critical max 9.8
TRUMPF: Multiple products affected by log4net vulnerability
The versions of TRUMPF products stated below are including a version of log4net that's prone to XXE (External XML Entities) attacks under certain circumstances. This means, the log4net code can be tricked into loading externally hosted, potentially malicious …
first Apr 22, 2025