PT-2022-16600

Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System Data Server versions V15.0.0.22020 and prior Description A CWE-665: Improper Initialization issue exists, potentially causing information exposure when an attacker sends a specially crafted message...

PT-2022-16606

Name of the Vulnerable Software and Affected Versions ClearSCADA versions all EcoStruxure Geo SCADA Expert 2019 versions all EcoStruxure Geo SCADA Expert 2020 versions all Description A vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed...

CVE-2022-24316: Improper Initialization

A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

Schneider Electric Interactive Graphical SCADA System 安全漏洞

Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. The Schneider Electric Interactive Graphical SCADA System suffers from a buffer overflow...

CVE-2022-24321: Improper Check for Unusual or Exceptional Conditions

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo...

CVE-2022-24313: Buffer Copy without Checking Size of Input

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020...

CVE-2022-24311: Improper Limitation of a Pathname to a Restricted Directory

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends...

PT-2022-16603

Name of the Vulnerable Software and Affected Versions ClearSCADA All Versions EcoStruxure Geo SCADA Expert 2019 All Versions EcoStruxure Geo SCADA Expert 2020 All Versions Description A CWE-295: Improper Certificate Validation issue exists, allowing a Man-in-the-Middle attack when communications...

PT-2022-16601

Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System Data Server versions prior to 15.0.0.22020 Description A Missing Authorization issue exists that could cause information exposure when an attacker sends a specific message. Recommendations For versions prior ...

EcoStruxure Geo SCADA Expert 信任管理问题漏洞

EcoStruxure Geo SCADA Expert is an integrated, scalable, and reliable supervisory control and data acquisition SCADA software A trust management issue vulnerability exists in EcoStruxure Geo SCADA Expert that stems from a possible man-in-the-middle attack when communication between a client and t...

Interactive Graphical SCADA System Data Server 缓冲区错误漏洞

The Schneider Electric Interactive Graphical Scada System is a Scada system for monitoring industrial processes from Schneider Electric, France. An out-of-bounds read vulnerability exists in the Schneider Electric Interactive Graphical Scada System, which can be exploited by an attacker to cause ...

EcoStruxure Geo SCADA Expert 代码问题漏洞

EcoStruxure Geo SCADA Expert is an integrated, scalable, and reliable surveillance and data acquisition SCADA software A code issue vulnerability exists in EcoStruxure Geo SCADA Expert that stems from a denial of service to the Geo SCADA server when an improper HTTP request is received...

CVE-2022-24317: Missing Authorization

A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server V15.0.0.22020 and prior...

PT-2022-16602

Name of the Vulnerable Software and Affected Versions ClearSCADA affected versions not specified EcoStruxure Geo SCADA Expert 2019 affected versions not specified EcoStruxure Geo SCADA Expert 2020 affected versions not specified Description A vulnerability exists that could cause non-encrypted...

CVE-2022-24318: Inadequate Encryption Strength

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo SCADA Expert...

CVE-2022-24319: Improper Certificate Validation

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo...

Siemens SIMATIC WinCC Information Disclosure Vulnerability

Siemens SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. An information disclosure vulnerability exists in Siemens SIMATIC WinCC, which can be exploited by an attacker to forcibly obtain credentials and take over the system using this command...

PT-2022-1814

Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System Data Server versions V15.0.0.22020 and prior Description The issue is related to an out-of-bounds read, which could cause memory leaks and potentially result in denial of service. This can happen when an...

PT-2022-1815

Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System Data Server versions V15.0.0.22020 and prior Description A vulnerability exists that could cause modification of an existing file by inserting at the beginning of the file or create a new file in the context ...

Siemens Spectrum Power 4 Cross-Site Scripting Vulnerability

Spectrum Power provides essential components for SCADA, communications and data modeling for control and monitoring systems. Siemens Spectrum Power 4 suffers from a cross-site scripting vulnerability that can be exploited by an attacker to conduct an attack if an unsuspecting user is tricked into...