Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays Improper Input Validation (CVE-2018-16563)

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module All versions V4.35, Firmware variant MODBUS TCP for EN100 Ethernet module All versions, Firmware variant DNP3 TCP for EN100 Ethernet module All versions, Firmware variant IEC104 for EN100 Ethernet module A...

Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix Improper Input Validation (CVE-2017-9312)

Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a crafted TCP packet is received, the device reboots immediately. This plugin only works with Tenable.ot. Please visit...

Rockwell Automation MicroLogix 1100 Controllers Improper Input Validation (CVE-2017-7924)

An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB, and 1763-L16DWD. A remote, unauthenticated attacker could send a single, specially crafted Programmable Controller Communication Commands PCCC packet to the...

Schweitzer Engineering Laboratories RTAC Improper Input Validation (CVE-2013-2798)

Schweitzer Engineering Laboratories SEL SEL-2241, SEL-3505, and SEL-3530 RTAC master devices allow physically proximate attackers to cause a denial of service infinite loop via crafted input over a serial line. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-300 CPU Improper Input Validation (CVE-2018-16561)

A vulnerability has been identified in SIMATIC S7-300 CPUs All versions V3.X.16. The affected CPUs improperly validate S7 communication packets which could cause a Denial-of-Service condition of the CPU. The CPU will remain in DEFECT mode until manual restart. Successful exploitation requires an...

Siemens Mentor Nucleus Networking Module Improper Input Validation (CVE-2019-13939)

A vulnerability has been identified in APOGEE MEC/MBC/PXC P2 All versions = V2.8.2 and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and = V2.3x and V6.00.327, Nucleus NET All versions, Nucleus RTOS All...

Siemens SIMATIC S7-400 CPU Improper Input Validation (CVE-2018-4850)

A vulnerability has been identified in SIMATIC S7-400 incl. F CPU hardware version 4.0 and below All versions, SIMATIC S7-400 incl. F CPU hardware version 5.0 All firmware versions V5.2, SIMATIC S7-400H CPU hardware version 4.5 and below All versions. The affected CPUs improperly validate S7...

Mitsubishi Electric MELSEC iQ-R Series Uncontrolled Resource Consumption (CVE-2020-16850)

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to...

Siemens Industrial Real-Time Devices Improper Input Validation (CVE-2019-10923)

A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, SCALANCE X-200IRT switch family incl. SIPLUS NET variants,...

Siemens S7-400 CPUs Improper Input Validation (CVE-2018-16556)

A vulnerability has been identified in SIMATIC S7-400 incl. F V6 and below All versions, SIMATIC S7-400 PN/DP V7 incl. F All versions, SIMATIC S7-400H V4.5 and below All versions, SIMATIC S7-400H V6 All versions V6.0.9, SIMATIC S7-410 All versions V8.2.1. Specially crafted packets sent to port...

GE PACSystems CPE305/310, CPE330, CPE400, RSTi-EP CPE 100, CPU320/CRU320, RXi Improper Input Validation (CVE-2018-8867)

In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacke...

GE PACSystems RX3i Improper Input Validation (CVE-2019-13524)

GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versionsEnd of Life may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service...

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2022-22727

CVE-2022-22727 is an instance of an improper input validation (CWE-20) vulnerability in Schneider Electric’s EcoStruxure Power Monitoring Expert (versions 2020 and prior). The CVE describes that an unauthenticated attacker could view data, change settings, or impact availability, potentially affe...

CVE-2021-22288

The CVE-2021-22288 issue affects ABB Symphony Plus SPIET800 and PNI800 network interfaces. Public docs describe an Uncontrolled Resource Consumption vulnerability (CWE-400) that can cause the device to become unresponsive and require a reboot, with a CVSSv3.1 base score of 7.5 (Network, Low attac...