CVE-2018-15820: Improper Neutralization of Input During Web Page Generation

EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter...

CVE-2018-15819: Improper Authentication

EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js...

PT-2019-9191

Name of the Vulnerable Software and Affected Versions EasyIO EasyIO-30P versions prior to 2.0.5.27 Description The issue allows for XSS via the GDN parameter in the dev.htm endpoint. Recommendations For versions prior to 2.0.5.27, update to version 2.0.5.27 or later to resolve the issue. As a...

CVE-2015-3974: Undefined Security Weakness

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

PT-2015-6364

Name of the Vulnerable Software and Affected Versions EasyIO EasyIO-30P-SF controllers versions prior to 0.5.21 EasyIO EasyIO-30P-SF controllers versions 2.x prior to 2.0.5.21 Description The issue concerns a hardcoded password in the affected controllers, making it easier for remote attackers to...