CVE-2020-28211: Incorrect Authorization

A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause bypass of authentication when overwriting memory using a debugger...

CVE-2020-28212: Improper Restriction of Excessive Authentication Attempts

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when a brute force attack is done over Modbus...

PT-2020-6316

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert all versions Description A vulnerability exists in the PLC Simulator of EcoStruxure Control Expert that could cause bypass of authentication when overwriting memory using a debugger. This issue is related to incorrec...

PT-2020-6315

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert all versions Description A vulnerability exists in the PLC Simulator of EcoStruxure Control Expert software, related to improper check for unusual or exceptional conditions. This issue could cause a crash of the PLC...

CVE-2020-28213: Download of Code Without Integrity Check

A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when sending specially crafted requests over Modbus...

PT-2020-16947

Name of the Vulnerable Software and Affected Versions EcoStruxureª Control Expert now Unity Pro all versions Description A CWE-494: Download of Code Without Integrity Check issue exists in the PLC Simulator that could cause unauthorized command execution when sending specially crafted requests ov...

CVE-2020-7538: Improper Check for Unusual or Exceptional Conditions

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request...

Schneider Electric EcoStruxure Control Expert 授权问题漏洞

EcoStruxure Control Expert is the universal programming, debugging and operating software for the Modicon M340, M580, M580S, Premium, Momentum and Quantum series. A security vulnerability exists in PLC Simulator in EcoStruxure Control Expert. The vulnerability can be exploited by an attacker to...

PT-2020-6378

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert all versions Description A buffer copy without checking the size of input issue exists in the PLC Simulator of EcoStruxure Control Expert software. This could cause a crash of the PLC simulator when receiving a...

Schneider Electric EcoStruxure Control Expert 权限许可和访问控制问题漏洞

Schneider Electric EcoStruxure Control Expert is the universal programming, commissioning and operating software for the Modicon M340, M580, M580S, Premium, Momentum and Quantum series. An incorrect authorization vulnerability exists in PLC Simulator in Schneider Electric EcoStruxure Control...

Bugs in Critical Infrastructure Gear Allow Sophisticated Cyberattacks

Two security vulnerabilities in Schneider Electric’s programmable logic controllers PLCs could allow attackers to compromise a PLC and move on to more sophisticated critical infrastructure attacks. PLCs are key pieces of equipment in environments such as electric utilities and factories. They...

Schneider Electric EcoStruxure Control Expert PLC Denial of Service Vulnerability

Schneider Electric EcoStruxure Control Expert formerly Unity Pro is a suite of programming software for Schneider Electric logic controller products from Schneider Electric, France. A denial of service vulnerability exists in EcoStruxure Control Expert's PLC simulator, which originates when a...

PT-2020-15998

Name of the Vulnerable Software and Affected Versions WECON PLC Editor versions 1.3.8 and prior Description A stack-based buffer overflow issue has been identified that may allow arbitrary code execution. Recommendations For WECON PLC Editor versions 1.3.8 and prior, at the moment, there is no...

PT-2020-15999

Name of the Vulnerable Software and Affected Versions WECON PLC Editor versions 1.3.8 and prior Description A heap-based buffer overflow issue has been identified that may allow arbitrary code execution. Recommendations For versions 1.3.8 and prior, at the moment, there is no information about a...

WECON PLC Editor WCP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WECON PLC Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WC...

WECON PLC Editor WCP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WECON PLC Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WC...

WECON PLC Editor WCP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WECON PLC Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WC...

Schneider Electric PLC Simulator for EcoStruxure Control Expert

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: PLC Simulator for EcoStruxure Control Expert Vulnerability: Improper Check for Unusual or Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this...

Design/Logic Flaw

Visual Components owned by KUKA is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds ...

CVE-2020-10291

CVE-2020-10291 concerns Visual Components’ network license server used by KUKA simulators. The server binds UDP port 5093 on all interfaces without authentication, exposing sensitive system information via RMS Sentinel’s license protocol. The disclosed data includes hardware/OS characteristics an...