Unspecified Vulnerability in Multiple Weidmueller Models

Weidmueller IE-SW-VL05M-5TX and so on are an industrial Ethernet switch from Weidmueller, Germany. A security vulnerability exists in a number of Weidmueller products. The vulnerability stems from a failure of the authentication mechanism to perform brute force protection, which can be exploited ...

CVE-2019-16671

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remote authenticated users can crash a device with a special packet because of Uncontrolled Resource Consumption...

CVE-2019-16672

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext...

CVE-2019-16672

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext...

CVE-2019-16673

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Passwords are stored in cleartext and can be read by anyone with access to the device...

CVE-2019-16672

CVE-2019-16672 affects Weidmueller IE-SW-VL05M (and VL08MT) and IE-SW-PL10M families. The issue is missing encryption of sensitive credentials data transmitted by the device (cleartext). CERT@VDE/Red Hat and NVD entries cite high severity (CVSS v3 base score up to 9.8) with network access require...

CVE-2019-16672

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext...

CVE-2019-16670

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The Authentication mechanism has no brute-force prevention...

PT-2019-14757

Name of the Vulnerable Software and Affected Versions Weidmueller IE-SW-VL05M version 3.6.6 Build 16102415 Weidmueller IE-SW-VL08MT version 3.5.2 Build 16102415 Weidmueller IE-SW-PL10M version 3.3.16 Build 16102416 Description An issue was discovered where sensitive credentials data is transmitte...

CVE-2019-16674: Use of Insufficiently Random Values

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network...

CVE-2019-16671: Uncontrolled Resource Consumption

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remote authenticated users can crash a device with a special packet because of Uncontrolled Resource Consumption...

CVE-2019-16670: Improper Restriction of Excessive Authentication Attempts

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The Authentication mechanism has no brute-force prevention...

PT-2019-14759

Name of the Vulnerable Software and Affected Versions Weidmueller IE-SW-VL05M version 3.6.6 Build 16102415 Weidmueller IE-SW-VL08MT version 3.5.2 Build 16102415 Weidmueller IE-SW-PL10M version 3.3.16 Build 16102416 Description An issue allows authentication information used in a cookie to be...

PT-2019-14755

Name of the Vulnerable Software and Affected Versions Weidmueller IE-SW-VL05M version 3.6.6 Build 16102415 Weidmueller IE-SW-VL08MT version 3.5.2 Build 16102415 Weidmueller IE-SW-PL10M version 3.3.16 Build 16102416 Description The issue concerns the authentication mechanism, which lacks brute-for...

PT-2019-14758

Name of the Vulnerable Software and Affected Versions Weidmueller IE-SW-VL05M version 3.6.6 Build 16102415 Weidmueller IE-SW-VL08MT version 3.5.2 Build 16102415 Weidmueller IE-SW-PL10M version 3.3.16 Build 16102416 Description The issue concerns the storage of passwords in cleartext, allowing...

CVE-2019-16673: Insufficiently Protected Credentials

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Passwords are stored in cleartext and can be read by anyone with access to the device...

CVE-2019-16672: Cleartext Transmission of Sensitive Information

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext...

PT-2019-14756

Name of the Vulnerable Software and Affected Versions Weidmueller IE-SW-VL05M version 3.6.6 Build 16102415 Weidmueller IE-SW-VL08MT version 3.5.2 Build 16102415 Weidmueller IE-SW-PL10M version 3.3.16 Build 16102416 Description An issue allows remote authenticated users to crash a device with a...

This Week in Security News: APT33 Botnets Used for Extreme Narrow Targeting and Microsoft’s Patch Tuesday Arrives with A Patch for An IE Zero-Day

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the APT33 threat group that is using live C&C servers for extremely narrow targeting. Also, read about Trend Micro’s complete...

November 2019 Patch Tuesday – 74 vulns, 13 Critical, Actively Attacked IE vuln, Hyper-V escapes, Adobe

This month’s Microsoft Patch Tuesday addresses 74 vulnerabilities with 13 of them labeled as Critical. Of the 13 Critical vulns, 5 are for browsers and scripting engines. Out of the 8 remaining Critical vulns, 4 are potential hypervisor escapes in Hyper-V, as well as vulnerabilities in Microsoft...