CVE-2025-26366

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP requests...

CVE-2025-26339

A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP...

CVE-2024-56180

CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users c...

CVE-2024-56180 Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution

CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users c...

CVE-2024-56180

CVE-2024-56180 describes a critical deserialization vulnerability in the Apache EventMesh project: the eventmesh-meta-raft plugin in the master branch (no release version) accepts Hessian RPC data from untrusted sources, allowing remote code execution. Affects Windows/Linux/macOS environments. Ro...

CVE-2024-12013

A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform...

CVE-2024-12012

CVE-2024-12012 affects Nozomi Networks TCP/IP Gateway (firmware 12h). The flaw stems from CWE-598: GET requests carrying sensitive query strings leak the SHA-1 password hash and session tokens via the URL, enabling information leakage and potential bypass of authentication (pass-the-hash). Affect...

CVE-2025-0816

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device...

CVE-2025-0814

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC61850-MMS packets are sent to the device. The core functionality of the breaker remains intact during the attack...

CVE-2025-0327

CWE-269: Improper Privilege Management vulnerability exists for two services of which one managing audit trail data and the other acting as server managing client request that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standa...

CVE-2025-0814

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC61850-MMS packets are sent to the device. The core functionality of the breaker remains intact during the attack...

CVE-2025-0815

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device...

CVE-2025-0815

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device...

CVE-2025-0815

CVE-2025-0815 concerns Schneider Electric Enerlin’X IFE/eIFE devices, with an improper input validation (CWE-20) flaw that can cause a Denial-of-Service when malicious ICMPv6 packets are received. Public sources describe impact on IEC61850 services and device availability, without detailing explo...

CVE-2025-0816

CVE-2025-0816 describes an improper input validation vulnerability in Schneider Electric Enerlin’X IFE/eIFE devices that can cause a DoS when malicious IPv6 (and related IPv6/ICMPV6/IEC61850-MMS) traffic is received. The issue affects the product family’s network-facing functionality and can lead...

CVE-2025-0816

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device...

CVE-2025-0816

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device...

CVE-2025-0327

CWE-269: Improper Privilege Management vulnerability exists for two services of which one managing audit trail data and the other acting as server managing client request that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standa...

CVE-2025-0327

CWE-269: Improper Privilege Management vulnerability exists for two services of which one managing audit trail data and the other acting as server managing client request that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standa...

CVE-2025-0327

CVE-2025-0327 corresponds to an improper privilege management vulnerability in Schneider Electric EcoStruxure Process Expert (and EcoStruxure Process Expert for AVEVA System Platform) with two Windows services (one for audit trail data, one server for client requests). The root cause is modificat...