EUVD-2018-7677

Malware in sbrugna...

CVE-2018-15820

EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter...

CVE-2018-15819

EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js...

CVE-2018-15820

EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter...

Design/Logic Flaw

EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js...

Design/Logic Flaw

EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter...

CVE-2018-15820

EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter...

CVE-2018-15819

EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js...

CVE-2018-15819

CVE-2018-15819 affects EasyIO-30P controllers (versions before 2.0.5.27). The vulnerability arises from Incorrect Access Control in the web interface (webuser.js), enabling authentication bypass. Connected sources also note associated cross‑site scripting issues (CVE-2018-15820) and remote exploi...

CVE-2018-15820: Improper Neutralization of Input During Web Page Generation

EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter...

CVE-2018-15819: Improper Authentication

EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js...

EasyIO 30P Controller Detection (HTTP)

HTTP based detection of EasyIO 30P controllers. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

EasyIO 30P Authentication Bypass / Cross Site Scripting Vulnerabilities

EasyIO 30P versions prior to 2.0.5.27 suffer from authentication bypass and cross site scripting vulnerabilities. EasyIO 30P Authentication Bypass / Cross Site Scripting Vulnerabilities INFORMATION Product: EasyIO 30P http://www.easyio.com Affected versions: 2.0.5.27 tested on version 2.0.5.16 CV...

EasyIO 30P Authentication Bypass / Cross Site Scripting

INFORMATION Product: EasyIO 30P http://www.easyio.com Affected versions: 2.0.5.27 tested on version 2.0.5.16 CVE IDs: CVE-2018-15820 Stored XSS and CVE-2018-15819 Authentication bypass Remote-exploit: yes TIMELINE Vendor notification: 3rd August, 2018 Vendor acknowledgment: 22nd August, 2018 Patc...

PT-2019-9191

Name of the Vulnerable Software and Affected Versions EasyIO EasyIO-30P versions prior to 2.0.5.27 Description The issue allows for XSS via the GDN parameter in the dev.htm endpoint. Recommendations For versions prior to 2.0.5.27, update to version 2.0.5.27 or later to resolve the issue. As a...

PT-2019-9190

Name of the Vulnerable Software and Affected Versions EasyIO EasyIO-30P versions prior to 2.0.5.27 Description The issue is related to Incorrect Access Control in the webuser.js file. Recommendations For versions prior to 2.0.5.27, update to version 2.0.5.27 or later to resolve the issue...

EasyIO EasyIO-30P-SF Controller Hardcoding Vulnerability

The EasyIO EasyIO-30P-SF is a 32-bit controller for DDC Direct Digital Control systems. The EasyIO EasyIO-30P-SF controller uses hard-coded passwords that allow remote attackers to exploit vulnerabilities for unauthorized access...

CVE-2015-3974

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

Hardcoded credentials

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

CVE-2015-3974: Undefined Security Weakness

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...