Vijeo Citect, CitectSCADA, and PowerLogic SCADA systems are vulnerable to data collection and industrial automation process control. This vulnerability stems from deficiencies in access control for certain functions, allowing attackers to read arbitrary files, send HTTP requests, or cause service interruptions.

The vulnerabilities of systems for data collection and process control in Vijeo Citect, CitectSCADA, and PowerLogic SCADA are related to deficiencies in access control for certain functions. Exploiting these vulnerabilities can allow attackers to read arbitrary files, send HTTP requests, or cause...

IEC870IP driver buffer overflow vulnerability

AVEVA Vijeo Citect and AVEVA CitectSCADA are a suite of data acquisition and monitoring system SCADA software. iec870IP is one of the drivers. A buffer overflow vulnerability exists in the IEC870IP driver v4.14.02 and earlier versions, which can be exploited by an attacker to cause a server-side...

AVEVA Vijeo Citect and Citect SCADA (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit --------- Begin Update A Part 1 of 5 --------- Vendor: AVEVA and Schneider Electric Equipment: AVEVA’s Vijeo Citect and Citect SCADA; Schneider Electric’s Power SCADA Operation --------- End Update A Part...

Operational Technology Networks or OT

Operational Technology Networks or OT Notes: It’s mixing up OT with maritime, so probably isn’t suitable as is. The first section is really good, very relevant. We can use all of that. Once we get in to NMEA data, then it goes off topic. I suggest: Network equipment such as the Scalance Then a...

CVE-2019-16321

ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATHINFO...

Advantech WebAccess/SCADA Buffer Overflow Vulnerability (CNVD-2019-32466)

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A buffer overflow vulnerability exists ...

CVE-2019-3975

Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message...

CVE-2019-3975

Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message...

Stack overflow

Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message...

CVE-2019-3975

Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message...

CVE-2019-3975

Advantech WebAccess/SCADA 8.4.1 is affected by CVE-2019-3975 due to a stack-based buffer overflow in the webvprcs/IOCTL 70603 RPC handling, enabling a remote, unauthenticated attacker to execute arbitrary code. This is confirmed across multiple sources (Red Hat advisory, CNVD, NVD entry) with imp...

Advantech WebAccess/SCADA Buffer Overflow Vulnerability (CNVD-2019-32464)

Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphical display and real-time data control, and provides remote control and management of automation equipment. A buffer overflow vulnerability exists ...

CVE-2019-10994

Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is...

CVE-2019-10980

A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is...

CVE-2019-10994

Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is...

CVE-2019-10980

A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is...

Out-of-bounds

Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is...

Type confusion

A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is...

CVE-2019-10994

Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is...

CVE-2019-10994

CVE-2019-10994 affects LAquis SCADA 4.3.1.71, where the LQS file parser can trigger an out-of-bounds read that may disclose sensitive information. Public sources disagree on exploitability: some indicate local access is required (initial descriptions), while others describe remote disclosure poss...