CVE-2019-18255

CVE-2019-18255 concerns HMI/SCADA iFIX (GE Digital) versions 6.1 and prior. A local authenticated user can modify system-wide iFIX configurations through section objects, enabling privilege escalation (I/O/access unspecified beyond local). Multiple connected sources confirm the issue and note it ...

CVE-2019-18255

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation...

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

Authentication flaw

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

CVE-2020-15798

A vulnerability has been identified in SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions V16 Update 3a, SIMATIC HMI KTP Mobile Panels All versions V16 Update 3a, SINAMICS GH150 All versions, SINAMICS GL150 with option X30 All versions, SINAMICS GM150 with option X30 All versions,...

CVE-2020-15798

CVE-2020-15798 affects Siemens SIMATIC HMI Comfort Panels (incl. SIPLUS) and SIMATIC HMI KTP Mobile Panels, plus several SINAMICS models (GH150, GL150 X30, GM150 X30, SH150, SL150, SM120, SM150, SM150i). The vulnerability arises from the Telnet service not requiring authentication, allowing a rem...

GE Digital HMI/SCADA iFIX

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Low skill level to exploit Vendor: GE Digital Equipment: HMI/SCADA iFIX Vulnerabilities: Incorrect Permission Assignment for Critical Resource 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate their...

Memory Corruption Vulnerability in PLF Files for Processing Man Machine Applications in PM Designer V2.1.07.39 at Pingtong Technology Co.

Ltd. is a professional HMI manufacturer headquartered in Taiwan that integrates R&D, production, manufacturing and sales. A memory corruption vulnerability exists in the PLF file of the PM Designer V2.1.07.39 Processing HMI application of Pingtong Technology Co., Ltd. which can be exploited by...

Binary Vulnerability in PM Designer V2.1.07.39 at Pingtone Technology Co.

Ltd. is a professional HMI manufacturer headquartered in Taiwan that integrates R&D, production, manufacturing and sales. A binary vulnerability exists in PM Designer V2.1.07.39 of Pingtong Technology Co., Ltd. which can be exploited by attackers to cause a program crash...

Siemens Simatic Hmi License Issue Vulnerability

Siemens Simatic Hmi is a device from Siemens Germany that provides human-computer interaction for industrial automation equipment. Siemens Simatic Hmi has an authorization issue vulnerability that can be exploited by an attacker to run code via an unauthenticated Telnet exploit use...

Industrial Gear at Risk from Fuji Code-Execution Bugs

Industrial control software ICS from Fuji Electric is vulnerable to several high-severity arbitrary code-execution security bugs, according to a federal warning. Authorities are warning the flaws could allow physical attacks on factory and critical-infrastructure equipment. Fuji Electric’s Tellus...

Siemens SIMATIC HMI Comfort Panels & SIMATIC HMI KTP Mobile Panels

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC HMI Comfort Panels, SIMATIC HMI KTP Mobile Panels Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this...

Input validation

A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE version details in the notification that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI...

CVE-2020-28221

A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE version details in the notification that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI...

EasyBuilder Pro suffers from a dll hijacking vulnerability (CNVD-2021-05668)

EasyBuilder Pro is a HMI software developed by Wyland. EasyBuilder Pro suffers from a dll hijacking vulnerability, which can be exploited by attackers to gain server control privileges...

Where maritime cyber checklists fail

The coming IMO cyber security regulations are a step in the right direction towards vessel security, but the impracticality of assessing the cyber security of a ship, together with a huge skills shortage, leads classification societies towards checklist based assessments. Having seen some of thes...

Delta Electronics Industrial Automation DOPSoft 代码问题漏洞

DOPSoft is a Human Machine Interface HMI programming software from Delta Electronics. A null pointer dereference vulnerability exists in DOPSoft 4.0.8.21 and earlier versions when handling project files. An attacker could exploit this vulnerability to execute arbitrary code...

Apache Flink 路径遍历漏洞

Apache Flink is an efficient and distributed general purpose data processing platform. Apache Flink products have an arbitrary file write vulnerability that can be exploited by an attacker to read sensitive files on the server and with the help of hard-coded credentials exploit the vulnerability ...