4,108 results · Feed
-
High max 7.5ICSA-23-059-01 2 CVEs
Hitachi Energy Gateway Station
Successful exploitation of these vulnerabilities could cause affected modules to stop working.
-
Medium max 4.6ICSA-23-061-03 1 CVE
Rittal CMC III Access systems
Successful exploitation of this vulnerability could allow an attacker to open control cabinets secured with Rittal locks.
-
Medium max 6.4ICSMA-23-061-01 1 CVE
Medtronic Micro Clinician and InterStim Apps
Successful exploitation of this vulnerability could cause the clinician application’s custom password to be reset to default, resulting in unauthorized control of the clinician therapy application.
-
Critical max 8.1ICSA-23-061-02 1 CVE
Baicells Nova
Successful exploitation of this vulnerability could allow commands performed using pre-login execution and with root permissions.
-
Critical max 5.5ICSA-23-052-01 2 CVEs
Mitsubishi Electric MELSOFT iQ AppPortal
Successful exploitation of these vulnerabilities could allow a malicious attacker to make unidentified impacts such as authentication bypass, information disclosure, denial-of-service, or bypass IP address authentication.
-
Critical max 9.8ICSA-23-054-01 2 CVEs
PTC ThingWorx Edge
Successful exploitation of these vulnerabilities could allow an attacker to crash the device they accessed or could allow remote code execution.
-
High max 7.3
BD Alaris Infusion Central
This updated advisory is a follow-up to the original advisory titled ICSMA-23-047-01 BD Alaris Infusion Central that was published February 16, 2023, to the ICS webpage on www.cisa.gov/uscert.
first Feb 16, 2023 -
High max 7.6
Moxa UC Series
This updated advisory is a follow-up to the original advisory titled ICSA-22-333-04 Moxa UC Series that was published November 29, 2022, on the ICS webpage on cisa.gov/ICS.
first Nov 29, 2022 -
Medium max 5.3ICSA-23-047-13 1 CVE
Sub-IoT DASH 7 Alliance Protocol stack implementation
Successful exploitation of this vulnerability could allow an attacker to create an out-of-bounds write condition.
-
Critical max 9.3ICSA-23-045-01 1 CVE
Weintek EasyBuilder Pro cMT Series
Successful exploitation of this vulnerability could allow an attacker to gain control of the user's machine or gain sensitive information.
-
High max 8.8
Delta Electronics DIAEnergie
This updated advisory is a follow-up to the original advisory titled ICSA-22-298-06 Delta Electronics DIAEnergie (Update A) that was published November 10, 2022, to the ICS webpage at www.cisa.gov/uscert.
first Nov 10, 2022 -
High max 7.5
Siemens Nucleus RTOS FTP Server
The FTP server of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to genera…
first Oct 11, 2022 -
Critical max 9.3
Siemens SINUMERIK ONE and SINUMERIK MC
SINUMERIK ONE and SINUMERIK MC products are affected by a weak key protection vulnerability in the integrated S7-1500 CPU. The weak key protection vulnerability in the integrated S7-1500 CPU is documented in more detail in SSA-568427 [1]. Siemens has released…
first Nov 8, 2022 -
Critical
Siemens SCALANCE W1750D
The SCALANCE W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to denial of service, unauthenticated remote code execution or stored XSS. Siemens has rel…
first Nov 8, 2022 -
HighICSA-23-047-02 1 CVE
Siemens SCALANCE X200 IRT
Products of the SCALANCE X-200IRT switch family are affected by a denial of service vulnerability in the SNMP agent that could allow remote attackers to cause a denial of service condition. Siemens has released updates for the affected products and recommends…
-
Critical max 9.8ICSA-23-047-03 4 CVEs
Siemens Brownfield Connectivity Client
Siemens has released a new version for Brownfield Connectivity - Client that contains fixes for multiple vulnerabilities in the underlying OpenSSL library. Successful exploitation of these vulnerabilities could lead to Denial of Service (DoS). Siemens has rel…
-
High max 7.5ICSA-23-047-04 8 CVEs
Siemens Brownfield Connectivity Gateway
Siemens has released a new version for Brownfield Connectivity - Gateway that contains fixes for multiple vulnerabilities in the underlying Golang implementation. Successful exploitation of these vulnerabilities could lead to Denial of Service (DoS). Siemens …
-
High max 7.8ICSA-23-047-05 1 CVE
Siemens SiPass integrated AC5102 / ACC-G2 and ACC-AP
SiPass integrated ACC (Advanced Central Controller) devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileg…
-
High max 7.8ICSA-23-047-06 2 CVEs
Siemens Simcenter Femap before V2023.1
Simcenter Femap is affected by out of bounds read/write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulner…
-
Critical max 10.0ICSA-23-047-10 1 CVE
Siemens COMOS
COMOS is affected by memory corruption vulnerability in the cache validation service that could allow an attacker to execute arbitrary code or cause denial of service condition. Siemens has released updates for the affected products and recommends to update t…
-
Medium max 5.9ICSA-23-047-11 1 CVE
Siemens Mendix
Mendix applications contain an improper access control vulnerability that could allow an attacker to bypass XPath constraints and retrieve information using XPath queries that trigger errors. Siemens has released updates for the affected products and recommen…
-
High max 7.8ICSA-23-047-12 3 CVEs
Siemens JT Open, JT Utilities, and Parasolid
JT Open Toolkit, JT Utilities and Parasolid are affected by memory corruption vulnerabilities that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause the application …
-
Medium max 5.5
ARC Informatique PcVue
Successful exploitation of these vulnerabilities could allow an unauthorized user to access the email account, SIM card, and other data sources associated with the affected device.
first Dec 20, 2022 -
Critical max 9.1ICSA-23-040-01 2 CVEs
Control By Web X-400, X-600M
Successful exploitation of these vulnerabilities could allow an attacker to inject malicious JavaScript and execute arbitrary code remotely, which could result in a loss of sensitive information.
-
Critical max 9.8ICSA-23-040-02 7 CVEs
LS ELECTRIC XBC-DN32U
Successful exploitation of these vulnerabilities could allow an attacker to steal Programmable Logic Controller (PLC) information, cause users to lose communication with the PLC, modify PLC code, obtain credentials, and create a denial-of-service condition.
-
High max 7.5ICSA-23-040-03 2 CVEs
Johnson Controls System Configuration Tool (SCT)
Successful exploitation of these vulnerabilities could allow an attacker to access cookies and take over the user's session.
-
High max 7.8ICSA-23-040-04 3 CVEs
Horner Automation Cscape Envision RV
Successful exploitation of these vulnerabilities could lead to an attacker executing arbitrary code via malicious project files.
-
Medium max 6.3ICSA-23-037-01 1 CVE
EnOcean SmartServer
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the servers.
-
Critical max 8.1ICSA-23-033-03 1 CVE
Baicells Nova
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands.
-
Critical max 9.8
Mitsubishi Electric Multiple Factory Automation Products (Update B)
Successful exploitation of these vulnerabilities could create a denial-of-service condition or enable arbitrary code execution.
first Aug 30, 2022 -
High max 7.8ICSA-23-033-01 3 CVEs
Delta Electronics DIAScreen
Successful exploitation of these vulnerabilities could allow remote code execution.
-
High max 6.8ICSA-23-033-02 2 CVEs
Mitsubishi Electric GOT2000 Series and GT SoftGOT2000
Successful exploitation of these vulnerabilities could allow attackers to perform unintended operations through clickjacking (an attack that tricks users into clicking an invisible or disguised webpage element) or allow attackers to disclose sensitive informa…
-
Critical max 8.8ICSA-23-033-04 1 CVE
Delta Electronics DVW-W02W2-E2
Successful exploitation of this vulnerability could allow a threat actor with low privileges to gain root access to the device, which could then allow them to send malicious commands to managed devices.
-
Critical max 9.0ICSA-23-033-05 2 CVEs
Delta Electronics DX-2100-L1-CN
Successful exploitation of these vulnerabilities could allow an attacker with low privileges to gain root access or allow an unauthenticated attacker to perform remote code execution.
-
High max 7.8ICSA-23-031-01 2 CVEs
Delta Electronics DOPSoft
Successful exploitation of these vulnerabilities could allow for remote code execution.
-
Medium max 5.9
Mitsubishi Electric MELSEC iQ-F, iQ-R Series
These products are available in limited regions.
first Jan 17, 2023 -
High max 7.8ICSA-23-026-01 1 CVE
Delta Electronics CNCSoft ScreenEditor
Successful exploitation of this vulnerability could cause a buffer overflow condition, which could allow remote code execution.
-
High max 7.5ICSA-23-026-03 4 CVEs
Snap One Wattbox WB-300-IP-3
Successful exploitation of these vulnerabilities could lead to remote code execution on the device, password brute force, and bricking of the device.
-
High max 8.8ICSA-23-026-04 2 CVEs
Sierra Wireless AirLink Router with ALEOS Software
Successful exploitation of these vulnerabilities could allow a loss of sensitive information and could allow remote code execution.
-
High max 7.5ICSA-23-026-05 1 CVE
Mitsubishi Electric MELFA SD/SQ series and F-series Robot Controllers
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to a robot controller.