CVE-2016-5809

An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability ca...

CVE-2016-5818

CVE-2016-5818 affects Schneider Electric PowerLogic PM8ECC module up to version 2.651. The vulnerability arises from undocumented hard-coded credentials that grant access to the device, enabling remote access to configuration data. Public advisories note a remote-exploit possibility; no widely kn...

CVE-2017-5157

An issue was discovered in Schneider Electric homeLYnk Controller, LSS100100, all versions prior to V1.5.0. The homeLYnk controller is susceptible to a cross-site scripting attack. User inputs can be manipulated to cause execution of JavaScript code...

CVE-2016-8368

An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and QJ71E71-B2, all versions. The affected Ethernet interface module is connected to a MELSEC-Q PLC, which may allow a remote attacker to conne...

CVE-2016-8367

An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen...

CVE-2016-5815

An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make...

CVE-2016-5809

Schneider Electric IONXXXX Series Power Meters (ION73XX, ION75XX, ION76XX, ION8650, ION8800, PM5XXX) are affected by CVE-2016-5809 due to lack of a CSRF token during sessions. This enables unauthorized configuration changes to be made and saved. Public materials (e.g., Exploit-DB, Packet Storm, T...

CVE-2016-8374

CVE-2016-8374 affects Schneider Electric Magelis HMI panels (GTO, GTU, STO/STU, XBT lines) where the Web Gate Server Web UI can be overwhelmed, causing UNCONTROLLED RESOURCE CONSUMPTION and denial of service. Root cause is improper handling of HTTP requests leading to resource exhaustion; exploit...

CVE-2016-8370

The CVE affects Mitsubishi Electric MELSEC-Q series Ethernet interface modules QJ71E71-100, QJ71E71-B5, and QJ71E71-B2. Root cause is use of a broken or risky cryptographic algorithm, resulting in weakly encrypted passwords being transmitted to a MELSEC-Q PLC. Impact reported includes the possibi...

CVE-2017-5162

The CVE-2017-5162 entry affects BINOM3 Universal Multifunctional Electric Power Quality Meter. Root cause is improper access control: lack of authentication for a remote service allows access to device setup and configuration. Documented impact includes unauthorized access to configuration data a...

CVE-2017-5167

The CVE-2017-5167 issue affects BINOM3 Universal Multifunctional Electric Power Quality Meter due to a hard-coded password/Vulnerability: Users cannot change their passwords. Public advisories (ICS-CERT update and CVE entries) describe the impact as unauthorized access to the device, potential se...

CVE-2016-8352

An issue was discovered in Schneider Electric ConneXium firewalls TCSEFEC23F3F20 all versions, TCSEFEC23F3F21 all versions, TCSEFEC23FCF20 all versions, TCSEFEC23FCF21 all versions, and TCSEFEC2CF3F20 all versions. A stack-based buffer overflow can be triggered during the SNMP login authenticatio...

CVE-2017-5155

An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, which can allow a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by...

CVE-2016-8352

Schneider Electric ConneXium firewalls TCSEFEC23F3F20/21, TCSEFEC23FCF20/21, and TCSEFEC2CF3F20 are affected by a stack-based buffer overflow during SNMP login authentication, enabling remote code execution. Affected versions include all listed variants. Root cause: buffer overflow in SNMP login ...

CVE-2016-8367

CVE-2016-8367 affects Schneider Electric Magelis HMI panels (GTO, GTU, STO/STU, XBT) with web server functionality. The issue is uncontrolled resource consumption: an attacker can open multiple connections to the Web Gate Server and keep them open, causing denial of service by exhausting the serv...

CVE-2016-5815

CVE-2016-5815 affects Schneider Electric IONXXXX power meters (ION73XX/ION75XX/ION76XX/ION8650/ION8800/PM5XXX). The root cause is improper access control: no authentication is configured by default, allowing an unauthorized remote user to access the device management portal and change configurati...

CVE-2017-5155

CVE-2017-5155 affects Schneider Electric Wonderware Historian (2014 R2 SP1 P01 and earlier). Root cause: historically created logins with default passwords can let a remote attacker compromise Historian databases and potentially SQL resources beyond. Impact: as described, unauthorized access and ...

CVE-2016-9360

An issue was discovered in General Electric GE Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has acces...

CVE-2017-5167

An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option to change their own passwords...

CVE-2016-8354

CVE-2016-8354 affects Schneider Electric Unity PRO (before v11.1). Unity projects can be compiled to x86 instructions and loaded into the Unity PRO PLC Simulator; a specially crafted patched project can redirect control flow and cause the simulator to execute malicious code. Public vulnerability ...