Xovis PC2, PC2R and PC3 Sensor Cross-Site Request Forgery Vulnerability

The Xovis PC2, PC2R and PC3 are all sensor devices from Xovis USA. A cross-site request forgery vulnerability exists in the Xovis PC2, PC2R, and PC3 sensors using firmware version 3.6.0 and earlier, which can be exploited by remote attackers to perform unauthorized operations...

PT-2018-10779

Name of the Vulnerable Software and Affected Versions Xovis PC2, PC2R, and PC3 devices versions through 3.6.0 Description The issue allows Directory Traversal. Recommendations For Xovis PC2, PC2R, and PC3 devices versions through 3.6.0, update to a version later than 3.6.0 to resolve the issue...

CVE-2018-11718: Cross-Site Request Forgery (CSRF)

Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow CSRF...

CVE-2018-11719: Improper Restriction of XML External Entity Reference

Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE...

CVE-2018-11720: Improper Limitation of a Pathname to a Restricted Directory

Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow Directory Traversal...

PT-2018-10776

Name of the Vulnerable Software and Affected Versions Xovis PC2, PC2R, and PC3 devices versions through 3.6.0 Description The issue allows for CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations For Xovis PC2, PC2R, and PC3...

PT-2018-10777

Name of the Vulnerable Software and Affected Versions Xovis PC2, PC2R, and PC3 devices versions through 3.6.0 Description The issue allows XXE XML External Entity attacks. Recommendations For Xovis PC2, PC2R, and PC3 devices versions through 3.6.0, update to a version later than 3.6.0 to resolve...