Code injection

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401...

CVE-2021-30066

The CVE-2021-30066 entry applies to Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 (before 03.23) and Belden Tofino Xenon Security Appliance. A firmware-signature verification bypass for USB allows loading an arbitrary firmware image, enabling kernel/firmware upgrades with unsigned p...

CVE-2021-30066

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification for a USB stick can be bypassed. NOTE: this issue exists because of an...

CVE-2021-30065

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401...

CVE-2021-30065

CVE-2021-30065 affects Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 prior to 03.23 and TCSEFEA23F3F20/21, plus Belden Tofino Xenon Security Appliance. Root cause is an incomplete fix of CVE-2017-11401, enabling crafted ModBus packets to bypass the ModBus enforcer. Impact: bypass of...

CVE-2021-30064

The CVE affects Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 (before 03.23) and TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance. The root cause is hardcoded default credentials allowing SSH login, applicable when the device is in the uncommissioned/not-enabled state. ...

CVE-2021-30064

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials if the device is in the uncommissioned state...

CVE-2021-30061

CVE-2021-30061 affects Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23 and TCSEFEA23F3F20/21, plus Belden Tofino Xenon Security Appliance. The issue allows a physically proximate attacker to execute code via a crafted file on a USB stick. CVSS shows physical access with l...

CVE-2021-30061

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximate attackers can execute code via a crafted file on a USB stick...

Schneider Electric ConneXium Tofino Firewall和Schneider Electric Belden Tofino Xenon Security Appliance 信任管理问题漏洞

Schneider Electric ConneXium Tofino Firewall and Schneider Electric Belden Tofino Xenon Security Appliance are both products of Schneider Electric, a French company. The Schneider Electric ConneXium Tofino Firewall is a firewall appliance and the Schneider Electric Belden Tofino Xenon Security...

Schneider Electric ConneXium Network Manager Software 数据伪造问题漏洞

Schneider Electric ConneXium Network Manager Software Schneider Electric Cnm is an industrial Ethernet network management software from Schneider Electric, France. A security vulnerability exists in the Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22/21/20 prior to version 03.23 and t...

Schneider Electric ConneXium Tofino Firewall 安全漏洞

Schneider Electric ConneXium Tofino Firewall is a firewall appliance from Schneider Electric France. A security vulnerability exists in the Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 prior to version 03.23 , TCSEFEA23F3F20/21 and Belden Tofino Xenon Security Appliance, which...

Authentication Bypass Vulnerability in Zyxel Firmware

THREAT LEVEL: Amber For a detailed advisory, download the pdf file here A severe vulnerability CVE-2022-0342 has been discovered in the firmware of some of Zyxels business-grade firewall and VPN products, potentially allowing attackers administrator-level access to affected devices. This...

Security Bulletin: Vulnerability in Netty - CVE-2021-43797 may affect IBM Watson Assistant for IBM Cloud Pak for Data.

Summary Potential vulnerabilities in Netty - CVE-2021-43797 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID: CVE-2021-43797 DESCRIPTION: Netty is vulnerable to HTTP request smuggling,...

Vulnerability fixed in Zyxel Firewall and VPN systems

Zyxel has fixed a vulnerability in USG/ZyWALL, USG FLEX, ATP, VPN, and NSG systems. An unauthenticated malicious party could potentially exploit the vulnerability to gain access on the vulnerable system and from there move further into the infrastructure to be protectable infrastructure. The...

CVE-2021-3714

A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via a local exploitation mechanism. The same technique can be used if an attacker can upload page sized files and detect the change in access time from a network...

OSS API Firewall Unveils new Feature: Blacklist for Compromised API Tokens and Cookies

Discovering and securing any API is one of the most difficult challenges for developers. The API security landscape is constantly evolving, with new threats and vulnerabilities emerging at a rapid pace. Since commercial API security solutions could be really expensive for organizations, its never...

Hitachi Energy e-mesh EMS

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: e-mesh EMS Vulnerabilities: Improper Restriction of Operations Within the Bounds of a Memory Buffer, Use After Free, Uncontrolled Resource Consumption 2. RISK EVALUATION...

Sophos Firewall Authentication Bypass Vulnerability

An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution...

How to Create Application Firewall Policy for Chunk Requests to Bypass Application Firewall on Citrix ADC 8.1-9.3

This article describes how to create application firewall policy for chunk requests to bypass Application Firewall module. Background In NetScaler software release 8.1 to 9.3 the Application Firewall module does not support chunked request. As a workaround you can create an Application Firewall...