Hitachi Energy PCM600 Information Disclosure Vulnerability

The Hitachi Energy PCM600 is a simplified management tool for protection and control relays from Hitachi, Japan. An information disclosure vulnerability exists in Hitachi Energy PCM600. The vulnerability stems from where IED credentials are stored in the PCM600 database in plaintext format. An...

CVE-2022-2513 Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products

A vulnerability exists in the Intelligent Electronic Device IED Connectivity Package ConnPack credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An...

CVE-2022-2513

Summary: CVE-2022-2513 affects Hitachi Energy’s PCM600 and related IED ConnPack packages where credentials are stored in cleartext in the PCM600 database and logs. The root cause is cleartext credential storage, enabling credential disclosure if an attacker obtains exported backups or has admin a...

Hitachi Energy PCM600 安全漏洞

The Hitachi Energy PCM600 is a simplified management tool for protection and control relays from Hitachi, Japan. An information disclosure vulnerability exists in Hitachi Energy PCM600. The vulnerability stems from where IED credentials are stored in the PCM600 database in plaintext format. An...

CVE-2021-27428

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

CVE-2021-27426

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

Code injection

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

CVE-2021-27426

CVE-2021-27426 affects GE UR family UR IEDs; prior to firmware 8.1x with Basic security, the device does not allow disabling Factory Mode, enabling servicing by factory users. Root cause is an insecure default variable initialization (CWE-453). Impact per sources includes potential bypass of acce...

CVE-2021-27426 GE UR family insecure default variable initialization

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

CVE-2021-27428

CVE-2021-27428 affects GE UR family UR IED firmware prior to 8.1x, where the UR Setup (Enervista UR Setup) firmware upgrade flow does not enforce appropriate privileges, allowing an illegitimate user to upgrade firmware. The weakness centers on Unrestricted Upload of a Dangerous Type; the vulnera...

vahdunajipel.eu Improper Access Control vulnerability OBB-2262499

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

libIEC61850 Null Pointer Dereference Vulnerability

libIEC61850 is an open source GPLv3 implementation of the IEC 61850 client and server libraries. A null pointer dereference vulnerability exists in ClientDataSetgetValues in client/iedconnection.c in libIEC61850 1.3, which can be exploited by an attacker to cause a denial of service null pointer...

CVE-2002-2270

Unspecified vulnerability in the ied command in HP-UX 10.10, 10.20, and 11.0 allows local users to view "normally invisible data" via unknown attack vectors...

CVE-2002-2270

The CVE-2002-2270 entry concerns HP-UX (versions 10.10, 10.20, 11.0) with an unspecified vulnerability in the built‑in ied command that allows local users to view normally invisible data via unknown attack vectors. The affected component is the ied command on those HP-UX releases; the underlying ...

HP-UX PHCO_24446 : HPSBUX0212-227 Sec. Vulnerability in ied(1)

s700800 11.00 ied1 patch : the ied1 command reveals data improperly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and patch checks in this plugin were extracted from HP patch PHCO24446. The text itself is copyright C Hewlett-Packard Development Company, L.P...