CVE-2024-26293

The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS...

CVE-2024-26293

The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS...

CVE-2024-26293

CVE-2024-26293 affects Avid NEXIS products via a vulnerable gSOAP v2.8 instance, enabling Unauthenticated Path Traversal. Impacted are Avid NEXIS E-series, F-series, PRO+ and System Director Appliance (SDA+) versions prior to 2025.5.1. Descriptions across NVD/Red Hat/CVELIST and related sources c...

CVE-2024-26293: Dependency on Vulnerable Third-Party Component

The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS...

CVE-2024-26291: Improper Authorization

An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges root/NTAUTHORITY SYSTEM by default attackers are ab...

Avid多款产品 安全漏洞

Avid NEXIS E-series, among others, is a virtualized storage platform from Avid, USA. A security vulnerability exists in various Avid products that stems from the use of a vulnerable version of gSOAP, which could lead to an unauthenticated path traversal attack. The following products and versions...

Avid多款产品 安全漏洞

Avid NEXIS E-series, among others, is a virtualized storage platform from Avid, USA. A security vulnerability exists in various Avid products, which stems from a vulnerability that could lead to an arbitrary file deletion attack. The following products and versions are affected: Avid NEXIS...

CVE-2025-5241

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unabl...

CVE-2025-5241

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unabl...

CVE-2025-5241

CVE-2025-5241 affects Mitsubishi Electric MELSEC iQ-F Series. A remote, unauthenticated attacker can trigger a denial-of-service by exploiting an overly restrictive account lockout mechanism, causing legitimate users to be blocked for a period after repeated incorrect login attempts. The impact i...

CVE-2025-5241 Denial-of-Service Vulnerability in MELSEC iQ-F Series

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unabl...

Mitsubishi Electric MELSEC iQ-F Series 安全漏洞

Mitsubishi Electric MELSEC iQ-F Series is a series of simple motion controllers from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC iQ-F Series that stems from an overly strict account lockout mechanism that could allow a remote, unauthenticated...

CVE-2025-5241: Overly Restrictive Account Lockout Mechanism

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unabl...

Mitsubishi Electric MELSEC iQ-F Series Improper Validation of Specified Index, Position, or Offset in Input (CVE-2025-3755)

This vulnerability allows a remote attacker to read information in the product, to cause a Denial-of-Service DoS condition in MELSOFT connection, or to stop the operation of the CPU module causing a DoS condtion on the CPU module, by sending specially crafted packets. The product is needed to res...

PHOENIX CONTACT多款产品 安全漏洞

PHOENIX CONTACT AXC F 1152 and others are a controller device from PHOENIX CONTACT, Germany. A security vulnerability exists in various PHOENIX CONTACT products, which stems from incorrect default permissions in the configuration file, which could lead to a low-privilege attacker forcing the...

PHOENIX CONTACT多款产品 后置链接漏洞

PHOENIX CONTACT AXC F 1152 and others are a controller device from PHOENIX CONTACT, Germany. A post-link vulnerability exists in several PHOENIX CONTACT products, which can be exploited by a low-privileged remote attacker to gain read, write, and execute privileges to arbitrary files on the devic...

PHOENIX CONTACT多款产品 后置链接漏洞

PHOENIX CONTACT AXC F 1152 and others are a controller device from PHOENIX CONTACT, Germany. A backlink vulnerability exists in various PHOENIX CONTACT products, which stems from the fact that key files used by the watchdog can be replaced, potentially allowing a low-privileged attacker to gain...

PHOENIX CONTACT多款产品 后置链接漏洞

PHOENIX CONTACT AXC F 1152 is a controller device from PHOENIX CONTACT. A backlink vulnerability exists in several PHOENIX CONTACT products, which can be exploited by a low-privilege remote attacker to gain read, write, and execute privileges to arbitrary files on the device by replacing key file...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS advisories on July 3, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-184-01 Hitachi Energy Relion 670/650 and SAM600-IO Series ICSA-25-184-02 Hitachi Energy...

Mitsubishi Electric MELSEC iQ-F Series

RISK EVALUATION Successful exploitation of this vulnerability could result in a denial-of-service condition for legitimate users for a certain period by repeatedly attempting to log in with incorrect passwords. When the product repeatedly receives unauthorized logins from an attacker, legitimate...