PT-2023-1669 · Unknown · Kostac Plc Programming

Name of the Vulnerable Software and Affected Versions: Kostac PLC Programming Software versions 1.6.9.0 and earlier Description: The issue is related to an out-of-bounds read vulnerability that occurs when processing a comment block in stage information. This can lead to information disclosure...

The vulnerability of the MKLogic-500 PLC, related to the use of pre-set credentials, allows a hacker to gain access to the contents of the FTP server.

The vulnerability of the PLK MKLogic-500 is related to the presence of pre-installed account data. Exploiting this vulnerability can allow a remote attacker to gain access to the contents of the FTP server...

Wago PLC Cycle Time Influences Uncontrolled Resource Consumption (CVE-2019-10953)

ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets. This plugin only works with Tenable.ot. Please visit...

Schneider Electric PLC Cycle Time Influences Uncontrolled Resource Consumption (CVE-2019-10953)

ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets. This plugin only works with Tenable.ot. Please visit...

Schneider Electric Modicon M221 Information Management Errors (CVE-2018-7790)

An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a...

Schneider Electric Modicon M221 Permissions, Privileges, and Access Controls (CVE-2018-7791)

A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to overwrite the original password with their password. If an attacker exploits this...

Schneider Electric Modicon M221 Programmable Logic Controller Missing Encryption of Sensitive Data (CVE-2020-7567)

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke t...

Schneider Electric Modicon Uncontrolled Resource Consumption (CVE-2013-2763)

DISPUTED The Schneider Electric M340 PLC modules allow remote attackers to cause a denial of service resource consumption via unspecified vectors. NOTE: the vendor reportedly disputes this issue because it could not be duplicated and an attacker could not remotely exploit this observed behavior t...

Schneider Electric Modicon M221 Programmable Logic Controller Inadequate Encryption Strength (CVE-2020-7565)

A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. This plugin on...

Osprey Pump Controller 1.0.1 Cross Site Scripting

Osprey Pump Controller 1.0.1 Unauthenticated Reflected XSS Vendor: ProPump and Controls, Inc. Product web page: https://www.propumpservice.com | https://www.pumpstationparts.com Affected version: Software Build ID 20211018, Production 10/18/2021 Mirage App: MirageAppManager, Release 1.0.1 Mirage...

Osprey Pump Controller 1.0.1 Unauthenticated Remote Code Execution Exploit

Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21680)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication for the PLC to perform critical functions and can be exploited by an...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21679)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An access control error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication for the delete command and can be exploited by an attacker to delete...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21678)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication of the PLC's created user, and can be exploited by an attacker to create a...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21677)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80. The vulnerability stems from the device's inability to properly control access to the PLC via its internal XGT...

LS ELECTRIC XBC-DN32U Information Disclosure Vulnerability

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An information disclosure vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which originates when the device transmits sensitive information in clear text when communicating via the XGT...

LS ELECTRIC XBC-DN32U Denial of Service Vulnerability

LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC Korea.A denial of service vulnerability exists in the LS ELECTRIC XBC-DN32U. The vulnerability stems from the fact that the device will stop functioning when accessing a memory location outside of the communication...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability

LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC Korea. LS ELECTRIC XBC-DN32U version 01.80 is vulnerable to an access control error, which could be exploited to remotely set the function to lock out the user from reading data from the device...

CVE-2023-22807

LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol...

CVE-2023-22803

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily...