CVE-2021-32935 Cognex In-Sight OPC Server - Deserialization of Untrusted Data

The affected Cognex product, the In-Sight OPC Server versions v5.7.4 96 and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation...

CVE-2021-32935: Deserialization of Untrusted Data

The affected Cognex product, the In-Sight OPC Server versions v5.7.4 96 and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation...

PT-2022-10155

Name of the Vulnerable Software and Affected Versions In-Sight OPC Server versions v5.7.4 and prior Description The issue allows a remote attacker to access system level permission commands and potentially achieve local privilege escalation due to the deserialization of untrusted data...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

CVE-2022-30551

CVE-2022-30551 affects OPC UA Legacy Java Stack (version 2022-04-01). A remote attacker can send crafted OPC UA messages that exhaust server resources, causing the server to stop processing messages (DoS). The related records (Red Hat, CNVD, NVD, ZDI) describe the same denial-of-service impact an...

PT-2022-20173

Name of the Vulnerable Software and Affected Versions OPC UA Legacy Java Stack version 2022-04-01 Description The issue allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources. This can lead to a denial-of-service...

CVE-2022-30551: Uncontrolled Resource Consumption

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

Siemens Industrial Products with OPC UA

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC NET PC, SITOP Manager, TeleControl Server Basic Vulnerability: Null Pointer Dereference 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory...

Siemens Industrial Products

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2022-6555 · Softing · Softing Edgeconnector +5

Name of the Vulnerable Software and Affected Versions: Softing OPC UA C++ Server SDK affected versions not specified Softing Secure Integration Server affected versions not specified Softing edgeAggregator affected versions not specified Softing edgeConnector affected versions not specified Softi...

Mitsubishi Electric MELSOFT GT OPC UA

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSOFT GT OPC UA Client Vulnerabilities: Out-of-bounds Read, Integer Overflow or Wraparound 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

Feds: APTs Have Tools That Can Take Over Critical Infrastructure

Threat actors have built and are ready to deploy tools that can take over a number of widely used industrial control system ICS devices, which spells trouble for critical infrastructure providers—particularly those in the energy sector, federal agencies have warned. In a joint advisory, the...

Siemens OPC UA Protocol Stack Discovery Service (Update E)

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerabilities: Improper restriction of XML external entity reference 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled...

The vulnerability of the centralized system for managing emergency messages and events in CAMS for HIS distributed control systems CENTUM VP and CENTUM VP Entry Class, along with the OPC-server Exaopc, allows a perpetrator to write arbitrary files.

The vulnerability of the centralized system for managing emergency messages and events in CAMS for HIS distributed control systems CENTUM VP and CENTUM VP Entry Class, along with the OPC-server Exaopc, is related to errors in processing the relative path to the catalog. Exploiting this...

The vulnerability of the centralized system for managing emergency messages and events in CAMS for HIS distributed control systems CENTUM VP and CENTUM VP Entry Class, along with the OPC-server Exaopc, allows a perpetrator to execute arbitrary commands.

The vulnerability of the centralized system for managing emergency messages and events in CAMS for HIS distributed control systems CENTUM VP and CENTUM VP Entry Class, along with the OPC-server Exaopc, is related to authentication process flaws. Exploiting this vulnerability could allow attackers...

Schneider Electric ConneXium Network Manager Software Denial of Service Vulnerability

Schneider Electric ConneXium Network Manager Software, an industrial Ethernet network management software from Schneider Electric, France, is vulnerable to a denial of service in Schneider Electric ConneXium Network Manager Software03.23 and earlier versions contain a denial of service...

CVE-2021-32994

Softing OPC UA C++ SDK Software Development Kit versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locatio...