Description
An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VEGA Grieshaber | VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL) | 1.0.0, 1.1.0 | — |
Advisories 4
- VDE-2026-016 VEGA: Unsecured Configuration Interface Allows Unauthorized Access Leading to Privilege Escalation CERT@VDE · Oct 30, 2026
- VDE-2026-046 VEGA: Missing Authentication for critical function in VEGAPULS two- and four-wire products CERT@VDE · Oct 2, 2026
- VDE-2026-047 VEGA: Missing Authentication for critical function in VEGAPULS Air products CERT@VDE · Oct 2, 2026
- VDE-2026-048 VEGA: Missing Authentication for critical function in VEGAPULS Bluetooth products CERT@VDE · Oct 2, 2026
References
- https://certvde.com/en/advisories/VDE-2026-016 vendor-advisory
- https://vega.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-016.json vendor-advisory