Schneider Electric EcoStruxure Control Expert 缓冲区错误漏洞

Schneider Electric EcoStruxure Control Expert formerly known as Unity Pro is a suite of programming software for Schneider Electric logic controller products from Schneider Electric, France. A buffer error vulnerability exists in Schneider Electric EcoStruxure Control Expert version V15.1 HF001 a...

CVE-2022-37300

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions former name of...

Design/Logic Flaw

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions former name of...

CVE-2022-37300

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions former name of...

CVE-2022-37300

CVE-2022-37300 is a CWE-640 weakness (Weak Password Recovery Mechanism) that could allow unauthorized read/write access to Schneider Electric controllers over Modbus. Affected products and versions include EcoStruxure Control Expert (Unity Pro lineage) up to V15.0 SP1, EcoStruxure Process Expert ...

CVE-2022-37300: Weak Password Recovery Mechanism for Forgotten Password

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions former name of...

EcoStruxure Control Expert Backup Code Execution

The vulnerability of the backup function for source files in the target programming system, the EcoStruxure Control Expert programmable logic controllers, is related to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code o...

EcoStruxure Control Expert RemoteConnect Unauthenticated Access

The vulnerabilities of the PLC programming software EcoStruxure Control Expert, the automation system ProcessExpert, and the configuration software SCADAPack RemoteConnect are related to insufficient protection for registration data. Exploiting these vulnerabilities can allow attackers to gain...

EcoStruxure Control Expert Buffer Overflow DoS

The vulnerability of the EcoStruxure Control Expert programming tool for programmable logic controllers involves the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

EcoStruxure Control Expert Process Expert Modbus Password Bypass

The vulnerabilities of the programming software for PLCs programmable logic controllers, the EcoStruxure Control Expert system for automating technological processes, and the micro-programming software for programmable logic controllers—such as Schneider Electric Modicon M340 and M580—are related...

PT-2022-4154 · Schneider Electric · Ecostruxure Control Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert versions V15.1 HF001 and prior Description: A memory buffer issue exists that could cause a crash of the Control Expert software when an incorrect project file is opened. The issue is related to improper restriction...

PT-2022-4129 · Schneider Electric · Modicon M340 Cpu +3

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert versions V15.0 SP1 and prior EcoStruxure Process Expert versions V2021 and prior Modicon M340 CPU versions V3.40 and prior Modicon M580 CPU versions V3.20 and prior Description: A Weak Password Recovery Mechanism fo...

EcoStruxure Control Expert Buffer Overflow

The vulnerabilities of the programming software for PLCs programmable logic controllers, the configuration software SCADAPack RemoteConnect, and the automation system for technological processes EcoStruxure Process Expert are related to writing beyond the buffer boundaries in memory. Exploiting...

PLC EcoStruxure Control Expert Authentication Bypass

The vulnerabilities of the EcoStruxure Control Expert programming tool, the ProcessExpert automation system, the SCADAPack RemoteConnect configuration tool, and the Modicon M580 and Modicon M340 programmable logic controllers are related to the ability to bypass authentication through spoofing...

PT-2022-3587 · Schneider Electric · Ecostruxure Process Expert +2

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert affected versions not specified EcoStruxure Process Expert affected versions not specified SCADAPack RemoteConnect affected versions not specified Description: The issue is related to a buffer overflow in memory,...

AT&T Labs Xmill 缓冲区错误漏洞

AT&T Labs Xmill is a new tool for efficiently compressing XML data from AT&T Labs. A buffer error vulnerability exists in AT&T Labs' Compressor XMilI and decompressor XDemill, which could be exploited by an attacker to cause code execution with elevated privileges on an engineering workstation. T...

CVE-2021-22797

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the...

Path traversal

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the...

CVE-2021-22797

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the...

CVE-2021-22797

CVE-2021-22797 is a CWE-22 path traversal vulnerability in Schneider Electric EcoStruxure Control Expert (incl. Unity Pro), EcoStruxure Process Expert, and SCADAPack RemoteConnect for x70. The root cause is improper validation of a user-supplied path when loading a malicious project file, which c...