CirCarLife Auth Bypass (CVE-2018-16670)

Exploits CVE-2018-16670 in CirCarLife 4.3: unauthenticated access to /html/devstat.html and /services/user/values.xml exposes PLC status data. !/usr/bin/env python3 -- coding: utf-8 -- """CirCarLife devstat auth bypass CVE-2018-16670.""" from kittysploit import from lib.protocols.http.httpclient...

CirCarLife <4.3 - Improper Authentication Detection

CirCarLife before 4.3 is susceptible to improper authentication. A PLC status disclosure exists due to lack of authentication for /html/devstat.html. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 --...

Design/Logic Flaw

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...

PT-2018-13687

Name of the Vulnerable Software and Affected Versions CIRCONTROL CirCarLife versions prior to 4.3 Description An issue was discovered that allows PLC status disclosure due to a lack of authentication for the "/html/devstat.html" API endpoint. Recommendations For versions prior to 4.3, update to...

CVE-2018-16670: Improper Authentication

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html...