Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability

OVERVIEW Schneider Electric Wonderware has identified a stack-based buffer overflow vulnerability in the Wonderware InTouch Access Anywhere Server product. Schneider Electric has produced a security update that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED...

Mitsubishi Electric MELSEC FX3G PLC Device Resource Management Error Vulnerability

The Mitsubishi Electric MELSEC FX3G PLC is a programmable logic controller PLC product of the MELSEC FX series from Mitsubishi Electric Japan. A security vulnerability exists in the HTTP application of the Mitsubishi Electric MELSEC FX3G PLC device for products prior to the 2015.4 date. A remote...

General Electric MDS PulseNET FileDownloadServlet Directory Traversal (CVE-2015-6459)

A directory traversal vulnerability exists in the General Electric MDS PulseNET products. The vulnerability is due to insufficient validation in FileDownloadServlet. An unauthenticated remote attacker can exploit this vulnerability to read and then delete an arbitrary file on the system...

CVE-2015-3938

The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service device outage via a long parameter...

Design/Logic Flaw

The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service device outage via a long parameter...

CVE-2015-3938

The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service device outage via a long parameter...

CVE-2015-3938

The CVE-2015-3938 vulnerability affects Mitsubishi Electric MELSEC FX3G PLCs, where the built‑in HTTP application cannot handle parameters longer than expected. This leads to a remote denial-of-service (device outage), potentially requiring a reboot. Public details consistently point to the FX3G ...

CVE-2015-3938: Undefined Security Weakness

The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service device outage via a long parameter...

PT-2015-6350

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric MELSEC FX3G PLC devices versions prior to April 2015 Description The issue allows remote attackers to cause a denial of service, resulting in a device outage, by sending a long parameter to the HTTP application...

Schneider Electric InduSoft Web Studio Remote Agent Component Code Execution Vulnerability

Schneider Electric InduSoft Web Studio is an embedded HMI software package.Remote Agent is one of the remote agent components. A security vulnerability exists in the Remote Agent component of Schneider Electric InduSoft Web Studio that could be exploited by a remote attacker to submit a special...

CVE-2015-7375

Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service unhandled runtime exception and application crash via a crafted Indusoft Project file...

Design/Logic Flaw

The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649...

Code injection

Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service unhandled runtime exception and application crash via a crafted Indusoft Project file...

CVE-2015-7374

The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649...

CVE-2015-7374

CVE-2015-7374 affects Schneider Electric InduSoft Web Studio via the Remote Agent component (Windows). The vulnerability enables remote code execution due to lack of authentication on the Remote Agent service (TCP port 1234), allowing remote API calls to be executed with the process’s privileges....

CVE-2015-7375

Schneider Electric InduSoft Web Studio is affected by CVE-2015-7375. The vulnerability arises in the handling/parsing of Indusoft Project files, allowing remote code execution or a denial of service (unhandled runtime exception and application crash) in InduSoft Web Studio before version 8.0. Pub...

CVE-2015-7374

The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649...

CVE-2015-7375

Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service unhandled runtime exception and application crash via a crafted Indusoft Project file...

Siemens RUGGEDCOM ROX-based Devices NTP Vulnerabilities

OVERVIEW Siemens has reported to NCCIC/ICS-CERT that NTP daemon vulnerabilities exist in the Siemens RUGGEDCOM ROX-based devices. Siemens has produced firmware updates to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following Siemens...

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise Remote Code Execution Vulnerability

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric Company GE, U.S.A. GE Digital Energy MDS PulseNET is a suite of software applications for monitoring and controlling industrial communication network devices. Enterprise is an enterprise version of MD...