DAQFactory Deserialization Vulnerability

DAQFactory is a software and application development platform that provides a variety of tools that allow you to easily create HMI/SCADA applications. A deserialization vulnerability exists in DAQFactory 18.1 Build 2347 and earlier versions. An attacker can exploit this vulnerability to corrupt...

DAQFactory Man-in-the-Middle Attack Vulnerability

DAQFactory is a software and application development platform that provides a variety of tools that allow you to easily create HMI/SCADA applications. A man-in-the-middle attack vulnerability exists in DAQFactory 18.1 Build 2347 and earlier versions. The vulnerability can be exploited by an...

Unspecified vulnerability in DAQFactory

DAQFactory is a software and application development platform that provides a variety of tools that allow you to easily create HMI/SCADA applications. A security vulnerability exists in DAQFactory 18.1 Build 2347 and earlier versions. The vulnerability can be exploited by an attacker via a...

ICONICS GENESIS64 and Mitsubishi Electric MC Works64

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: ICONICS, Mitsubishi Electric Equipment: ICONICS GENESIS64, Mitsubishi Electric MC Works64 Vulnerabilities: Out-of-bounds Read, Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities may...

Ransomware Attacks against Water Treatment Plants

According to a report from CISA last week, there were three ransomware attacks against water treatment plants last year. WWS Sector cyber intrusions from 2019 to early 2021 include: In August 2021, malicious cyber actors used Ghost variant ransomware against a California-based WWS facility. The...

CISA – Ransomware targeted SCADA systems of 3 US water facilities

By Deeba Ahmed US has warned of more ransomware attacks on IT and OT networks of country's Water and Wastewater Systems WWS Sector facilities. This is a post from HackRead.com Read the original post: CISA - Ransomware targeted SCADA systems of 3 US water facilities...

CVE-2021-38431

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users...

Design/Logic Flaw

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users...

CVE-2021-38431

CVE-2021-38431 affects Advantech WebAccess SCADA (WebAccess/SCADA) versions 9.0.3 and earlier. An authenticated user can use API functions to disclose project names and paths from other users due to a missing authorization issue (CWE-862). The CVSS v3 base score is 4.3 (Network, Low attack comple...

Advantech WebAccess SCADA Authorization Issues Vulnerability

Advantech WebAccess SCADA is a set of SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphical display and real-time data control, and provides remote control and management of automation equipment. An authorization issue vulnerability...

Advantech WebAccess Stack Buffer Overflow Vulnerability (CNVD-2021-80266)

Advantech WebAccess is Advantech's suite of HMI/SCADA software based on browser architecture. A stack buffer overflow vulnerability exists in Advantech WebAccess 9.02 and earlier versions. An attacker could exploit this vulnerability to remotely execute code...

Advantech WebAccess Heap Buffer Overflow Vulnerability

Advantech WebAccess is Advantech's suite of HMI/SCADA software based on browser architecture. A heap buffer overflow vulnerability exists in Advantech WebAccess 9.02 and earlier versions. An attacker could exploit this vulnerability to remotely execute code...

Schneider Electric Interactive Graphical SCADA System访问控制错误漏洞（CNVD-2022-13073）

Schneider Electric Interactive Graphical SCADA System IGSS is an advanced SCADA system for monitoring and controlling industrial processes.Schneider Electric Interactive Graphical SCADA System is vulnerable to An access control error vulnerability can be exploited to delete arbitrary files in the...

CVE-2021-38431

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users...

Advantech WebAccess SCADA

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: WebAccess SCADA Vulnerability: Missing Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access project names and paths. 3...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: WebAccess Vulnerabilities: Heap-based Buffer Overflow, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to...

Schneider Electric IGSS 访问控制错误漏洞

Schneider Electric Interactive Graphical SCADA System IGSS is an advanced SCADA system for monitoring and controlling industrial processes.Schneider Electric Interactive Graphical SCADA System is vulnerable to An access control error vulnerability can be exploited to delete arbitrary files in the...

Cypress Solutions CTM-200/CTM-ONE Hard-Coded Credentials Remote Root

!/usr/bin/env python3 Cypress Solutions CTM-200/CTM-ONE Hard-coded Credentials Remote Root Telnet/SSH Vendor: Cypress Solutions Inc. Product web page: https://www.cypress.bc.ca Affected version: CTM-ONE 1.3.6-latest CTM-ONE 1.3.1 CTM-ONE 1.1.9 CTM200 2.7.1.5659-latest CTM200 2.0.5.3356-184 Summar...

Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection

Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection Vendor: Cypress Solutions Inc. Product web page: https://www.cypress.bc.ca Affected version: 2.7.1.5659 2.0.5.3356-184 Summary: CTM-200 is the industrial cellular wireless gateway for fixed and mobile applications. The CTM-200 is a...

CVE-2021-41578

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead ...