CVE-2024-26004

CVE-2024-26004 concerns Phoenix Contact CHARX SEC devices. The vulnerability is a denial-of-service condition caused by dereferencing a null/uninitialized pointer within CANopenDevice handling, allowing an unauthenticated, network-adjacent attacker to disrupt the charging/operation of affected in...

CVE-2024-26003

CVE-2024-26003 affects PHOENIX CONTACT CHARX SEC family (e.g., CHARX SEC-3000/3050/3100/3150) with an out-of-bounds read that enables an unauthenticated remote attacker to cause a DoS of the control agent, potentially disrupting charging functionality. Public references describe a buffer-read con...

CVE-2024-26002

CVE-2024-26002 affects Phoenix Contact CHARX SEC plctool on CHARX SEC-3100 devices. The issue is an improper input validation that allows a local, low-privilege attacker to escalate to root by changing ownership of specific files (local exploit, no user interaction required according to the CVE d...

CVE-2024-26001

Phoenix Contact CHARX SEC series devices (e.g., CHARX SEC-3100/CHARX SEC-3000 family) are affected by a vulnerability in the MQTT stack where improper input validation allows an unauthenticated, remote attacker to write memory out of bounds. The issue is described as a buffer/length validation fl...

CVE-2024-26000

CVE-2024-26000 affects Phoenix Contact CHARX SEC-3100 devices due to an out-of-bounds read in the MQTT stack caused by improper input validation. An unauthenticated remote attacker can read memory, with memory randomization reducing brute-force effectiveness. Multiple connected sources confirm th...

CVE-2024-25999

The CVE-2024-25999 entry concerns unauthenticated local privilege escalation via improper input validation in the OCPP agent service. Connected sources show a related class of vulnerabilities in Phoenix Contact CHARX SEC charging controllers (e.g., CHARX SEC-3100/CHARX SEC-3000) where an input va...

CVE-2024-25997

CVE-2024-25997 affects PHOENIX CONTACT CHARX SEC-3000 (and CHARX SEC series) due to improper input validation that enables unauthenticated remote attackers to inject data into logs. Public sources corroborate log injection as the impact, with affected CHARX SEC-3000 versions prior to v1.5.1. Expl...

CVE-2024-25996

CVE-2024-25996 affects PHOENIX CONTACT CHARX SEC devices (CHARX SEC-3000 family). The root cause is an origin validation error that enables an unauthenticated remote attacker to execute arbitrary code remotely. Impact is remote code execution with high severity; exploit appears network-proximate ...

CVE-2024-25995

CVE-2024-25995 involves PHOENIX CONTACT CHARX SEC-3000 (CHARX Series) AC charge controllers. The root cause is an input-validation/authentication flaw in critical functions, allowing an unauthenticated attacker to modify configurations and trigger remote code execution. Affected product versions ...

CVE-2024-25994

CVE-2024-25994 affects Phoenix Contact CHARX SEC devices (CHARX SEC-3100, and related SEC series). The CharxUpdateAgent service listens on TCP port 9999 and fails to validate user-supplied data, enabling an unauthenticated attacker to upload arbitrary script files to a fixed write-only location. ...

CVE-2024-21584

CVE-2024-21584 affects Pleasanter 1.3.49.0 and earlier, with a cross-site scripting (CWE-79) vulnerability. An attacker can lure a user to access the product via a specially crafted URL and perform a specific operation, potentially causing arbitrary script execution in the user’s browser. The iss...

CVE-2024-24964

CVE-2024-24964 affects SKYSEA Client View in Windows: improper access control in the resident process allows running arbitrary code as SYSTEM when a user with login access exploits it. Affected versions are SKYSEA Client View from Ver.11.220 up to (before) Ver.19.2. Remediation across sources poi...

CVE-2024-21805

SKYSEA Client View contains an improper access-control vulnerability (CVE-2024-21805) affecting versions 16.100 through prior to 19.3. A logged-in user can place a specially crafted DLL in a specific folder, potentially executing code with SYSTEM privileges. This is a local issue tied to the spec...

Stack overflow

DIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. B Firmware v2.03WWb01 suffer from a LAN-Side Unauthenticated Remote Code Execution RCE vulnerability elevated from HNAP Stack-Based Buffer Overflow...

Design/Logic Flaw

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...

Design/Logic Flaw

Insertion of Sensitive Information into Log File vulnerability in Hitachi Cosminexus Component Container allows local users to gain sensitive information.This issue affects Cosminexus Component Container: from 11-30 before 11-30-05, from 11-20 through 11-20-, from 11-10 through 11-10-, from 11-00...

CVE-2023-6814

The CVE-2023-6814 issue affects Hitachi Cosminexus Component Container and is caused by insertion of sensitive information into log files, leading to local information disclosure. Affected versions include 11-00 through 11-00-12, 11-10 through 11-10-10, 11-20 through 11-20-07, 11-30 through 11-30...

CVE-2024-25644

CVE-2024-25644 affects SAP NetWeaver WSRM 7.50. Under certain conditions, it allows an attacker to access information that would normally be restricted, yielding low impact on confidentiality and no impact on integrity or availability. The connected sources confirm the product and scope but do no...

CVE-2024-28339

CVE-2024-28339 describes an information leak in the debuginfo.htm component of Netgear CBR40, CBK40, and CBK43 routers (version 2.5.0.28). The issue allows attackers to obtain sensitive information without authentication, due to improper access control in the debuginfo.htm page. Publicly availabl...

CVE-2024-28340

CVE-2024-28340 affects NETGEAR CBR40/CBK40/CBK43 routers with firmware 2.5.0.28. The currentsetting.htm component exposes an information‑leak vulnerability that allows unauthenticated attackers to obtain sensitive data via the web interface due to insufficient access control. The CVSS v3.1 base s...