Schneider Electric Logic Controllers Encryption Key Disclosure

The vulnerability of the microprogrammed logic controllers from Schneider Electric, such as Modicon M221, M100, and M200, is related to insufficiently secure data encryption. Exploiting this vulnerability could allow a malicious actor to obtain the encryption key remotely...

FANUC Robot Controllers (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely Vendor: FANUC Equipment: R-30iA and R-30iB series controllers Vulnerabilities: Integer Coercion Error, Out-of-bounds Write 2. UPDATE INFORMATION This advisory is a follow-up to the original advisory titled ICSA-21-243-02P FANUC...

Modicon PacDrive Authentication Bypass IP Configuration

The vulnerability of the microprogrammed logic controllers Modicon and PacDrive lies in the absence of authentication for the critical function. Exploiting this vulnerability allows an attacker to remotely alter the device’s IP configuration...

Smartlink modular equipment PowerTag Wiser controllers Randomness Privilege Escalation

The vulnerability of the communication interface for Smartlink module equipment, the microprogrammed wireless energy sensor PowerTag, and Wiser controllers is related to the use of insufficiently random values. Exploiting this vulnerability could allow a remote attacker to exploit the system...

Modicon M218 Logic Controller Insufficient Data Authenticity

The vulnerability of microprogrammed software in Modicon M218, M218, M241, M251, and M258 logic controllers is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker operating remotely to execute arbitrary codes...

Researchers Uncover FIN8's New Backdoor Targeting Financial Institutions

A financially motivated threat actor notorious for setting its sights on retail, hospitality, and entertainment industries has been observed deploying a completely new backdoor on infected systems, indicating the operators are continuously retooling their malware arsenal to avoid detection and st...

Schneider Electric PLC Path Traversal

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium stems from incorrect restrictions on the path name in the restricted access catalog. Exploiting this vulnerability could allow an attacke...

Modbus Protocol Implementation

The vulnerability of the Modbus protocol implementation in microprogrammed logic controllers like Modicon Quantum is related to errors in privilege management. Exploiting this vulnerability could allow an attacker to cause service failures or unauthorized changes to the PLC’s configuration...

EcoStruxure Control Expert DoS

The vulnerability of the EcoStruxure Control Expert programming tool for programmable logic controllers is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to trigger a service failure remotely...

EcoStruxure Control Expert Auth Bypass

The vulnerability of the programming software for PLCs programmable logic controllers, EcoStruxure Control Expert, is related to improper authentication. Exploiting this vulnerability can allow an attacker to bypass authentication processes...

EcoStruxure Control Expert Auth Bypass

The vulnerability of the programming software for PLCs programmable logic controllers, EcoStruxure Control Expert, lies in the absence of restrictions on the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to bypass the authentication process remotely...

driver’s Privilege Escalation

The vulnerability of the driver for enabling Storage Spaces on Microsoft Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2021-0084

A flaw was found in the Linux kernel. This flaw allows a local authenticated user to enable the escalation of privileges due to improper input validation in the IntelR Ethernet Controllers X722 and 800 series Linux RMDA driver. The highest threat from this vulnerability is to confidentiality,...

CVE-2021-0003

A flaw was found in the Linux kernel. This flaw allows a local, authenticated user to enable information disclosure due to an improper conditions check in some IntelR Ethernet Controllers 800 series Linux drivers. The highest threat from this vulnerability is to confidentiality...

CVE-2021-0002

A flaw was found in the Linux kernel. This flaw allows a local, authenticated user to enable information disclosure or cause a denial of service due to an improper conditions check in some IntelR Ethernet Controllers 800 series Linux drivers. The highest threat from this vulnerability is to...

Exploit for Improper Authentication in Microsoft

PoC exploit for CVE-2021-36949, a vulnerability in Azure AD Conn...

CVE-2021-0004

Improper buffer restrictions in the firmware of IntelR Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user to potentially enable denial of service via local access...

CVE-2021-0002

Improper conditions check in some IntelR Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure or denial of service via local access...

CVE-2021-0003

Improper conditions check in some IntelR Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2021-0084

Improper input validation in the IntelR Ethernet Controllers X722 and 800 series Linux RMDA driver before version 1.3.19 may allow an authenticated user to potentially enable escalation of privilege via local access...