BruCON Primer: 10 Years and Cisco Talos Talks

Cisco Talos will have a significant presence at the 10th edition of BruCON, which kicks off this week. Below, you will find the presentations that Talos researchers will give, along with a brief overview of the topics they will discuss. We are fortunate to have multiple speakers presenting this...

CVE-2018-14792

WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files...

CVE-2018-14792

WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files...

Code injection

WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files...

CVE-2018-14792

WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files...

CVE-2018-14792

Affected product: WECON PLC Editor (version 1.3.3U). The CVE-2018-14792 entry describes a stack-based buffer overflow when processing project files, potentially allowing code execution within the current process. Details from connected sources identify the vulnerability as CWE-121 with a CVSS v3 ...

CirCarlife Scada Information Disclosure Vulnerability (CNVD-2018-19569)

CIRCONTROL CirCarLife is a parking lot automation management system from Circontrol, Spain. A security vulnerability exists in CIRCONTROL CirCarLife versions prior to 4.3 that stems from the program's lack of authentication of the /html/devstat.html file. A remote attacker could exploit the...

PT-2018-12727

Name of the Vulnerable Software and Affected Versions WECON PLC Editor version 1.3.3U Description The issue may allow an attacker to execute code under the current process when the software processes project files. Recommendations For version 1.3.3U, at the moment, there is no information about a...

CVE-2018-14792: Stack-based Buffer Overflow

WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files...

CVE-2018-16670

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

Design/Logic Flaw

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

CVE-2018-16670

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

CVE-2018-16670

The CIRCONTROL CirCarLife parking lot automation management system is vulnerable to a PLC status disclosure in versions prior to 4.3 . The root cause is a lack of authentication for the /html/devstat.html file, which allows a remote attacker to obtain sensitive PLC status information, potentially...

CVE-2018-16670: Improper Authentication

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

PT-2018-13687

Name of the Vulnerable Software and Affected Versions CIRCONTROL CirCarLife versions prior to 4.3 Description An issue was discovered that allows PLC status disclosure due to a lack of authentication for the "/html/devstat.html" API endpoint. Recommendations For versions prior to 4.3, update to...

WECON PLC Editor

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: WECON Equipment: PLC Editor Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could result in unauthorized code execution within the...

Rockwell Automation MicroLogix

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION : Exploitable remotely/low skill level to exploit. Vendor : Rockwell Equipment : MicroLogix Controller Vulnerabilities : Improper Authentication 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause denial of service,...

(0Day) Wecon PLC Editor plcdatacenter projectVersion Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wecon PLC Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

(0Day) Wecon PLC Editor prg_ldview DevCmt Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wecon PLC Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CirCarLife SCADA 4.3.0 - Credential Disclosure Exploit

Exploit for hardware platform in category web applications Exploit Title: CirCarLife SCADA 4.3.0 - Credential Disclosure Exploit Author: David Castro Vendor Homepage: https://circontrol.com/ Shodan Dork: Server: CirCarLife Server: PsiOcppApp Version: CirCarLife Scada all versions under 4.3.0 OCPP...