CVE-2015-6461

CVE-2015-6461 affects Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H PLC web servers. The vulnerability is a Remote File Inclusion that allows an attacker to craft a URL causi...

PLC Wireless Router GPN2.4P21-C-CN - Incorrect Access Control

PLC Wireless Router GPN2.4P21-C-CN - Incorrect Access Control Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Incorrect Access Control Date: 14/01/2019 Exploit Author: Kumar Saurav Reference: https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-incorrect-access-control/...

PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Request Forgery Exploit

Exploit for hardware platform in category web applications Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Cross-Site Request Forgery CSRF Exploit Author: Kumar Saurav Reference: https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-cross-site-request-forgery-csrf/ Vendo...

PLC Wireless Router GPN2.4P21-C-CN - Incorrect Access Control

Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Incorrect Access Control Date: 14/01/2019 Exploit Author: Kumar Saurav Reference: https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-incorrect-access-control/ Vendor: ChinaMobile Category: Hardware Version: GPN2.4P21-C-C...

CVE-2019-6282

The CVE-2019-6282 issue affects ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices running firmware W2001EN-00. The vulnerability is CSRF through the URI cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity, enabling an attacker to change the Wireless Security Password. Public exploit r...

CVE-2019-6279

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 suffer an Incorrect Access Control vulnerability exposed via cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity, enabling an attacker to change the wireless password. Root cause: improper access control on the...

The vulnerability of microprogrammed software in Siemens Simatic S7-400 programmable logic controllers is related to errors in checking input data by Ethernet, PROFIBUS, and MPI interfaces. This allows a malicious actor to trigger a service failure.

The vulnerability of microprogrammed programmable logic controllers from Siemens Simatic S7-400 is related to errors in the validation of input data by Ethernet, PROFIBUS, and MPI interfaces. Exploiting this vulnerability can allow an attacker to cause maintenance failures by sending a specially...

CVE-2019-9590

An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service persistent failure mode by sending a series of \x19\xb2\x00\x00\x00\x06\x43\x01\x00\xac\xff\x00 aka UID 0x43 requests to TCP port 502...

Design/Logic Flaw

An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service persistent failure mode by sending a series of \x19\xb2\x00\x00\x00\x06\x43\x01\x00\xac\xff\x00 aka UID 0x43 requests to TCP port 502...

CVE-2019-9590

CVE-2019-9590 affects the TENGCONTROL T-920 PLC, version v5.5. The issue allows a remote attacker to trigger a denial of service (persistent failure mode) by sending a specific payload: the byte sequence 0x19 0xB2 0x00 0x00 0x00 0x06 0x43 0x01 0x00 0xAC 0xFF 0x00 (UID 0x43) to TCP port 502. The a...

CVE-2019-9590

An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service persistent failure mode by sending a series of \x19\xb2\x00\x00\x00\x06\x43\x01\x00\xac\xff\x00 aka UID 0x43 requests to TCP port 502...

WAGO PLC Detection (OPC UA)

OPC UA based detection of WAGO PLC Controllers. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

WECON PLC Editor Detection (Windows SMB Login)

SMB login-based detection of WECON PLC Editor. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

What you can learn from Cisco Talos’ new oil pumpjack workshop

Paul Rascagneres wrote this blog post with contributions from Patrick DeSantis from Cisco Talos ARES Advanced Research/Embedded Systems. Executive summary Every day, more industrial control systems ICS become vulnerable to cyber attacks. As these massive, critical machines become more...

The vulnerability of the microprogramming software used in Schneider Electric Modicon programmable logic controllers stems from incorrect processing of data in the incoming HTTP headers. This allows attackers to cause malfunctions in the device’s operation.

The vulnerability of the microprogrammed logic controllers from Schneider Electric Modicon stems from the improper elimination of CR and LF characters before data is entered into the incoming HTTP headers. Exploiting this vulnerability can allow an attacker to cause a device failure...

Malware can fully compromise building control systems

By Waqas Enterprise security vendor ForeScout’s operational technology research unit has developed a PoC Proof-of-Concept malware that exposed the vulnerabilities in building automation systems BAS by compromising them due to the presence of two very critical bugs in the BAS's PLC programmable...

Unitronics PCOM Client

Unitronics Vision PLCs allow unauthenticated PCOM commands to query PLC registers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Unitronics PCOM Client', 'Description' = %q Unitronics Vision...

Authentication flaw

Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing...

CVE-2018-18995

Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing...

Hardcoded credentials

Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrative web interface to insert an HTML/Javascript payload into any of the device properties, which may allow an attacker to display/execute the payload in a visit...