CVE-2023-26866

GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover...

Command injection

GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover...

CVE-2023-26866

CVE-2023-26866 affects GreenPacket OH736 WR-1200 Indoor Unit (M-IDU-1.6.0.3_V1.1) and OT-235 (MH-46360-2.0.3-R5-GP). It enables remote command injection via pre-login execution, with root privileges and potential full system takeover. CVSS v3.1 base score 9.8 (NETWORK, HIGH impact on confidential...

Green Packet OH736 命令注入漏洞

The Green Packet OH736 is a router from Green Packet USA. A security vulnerability exists in the WR-1200 Indoor Unit, OT-235 M-IDU-1.6.0.3V1.1 version, and MH-46360-2.0.3-R5-GP version of the Green Packet OH736. By exploiting this vulnerability, an attacker can completely take over root privilege...

CVE-2023-26866

GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover...

Hitachi Energy IEC 61850 MMS-Server Improper Resource Shutdown or Release (CVE-2022-3353)

A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the vulnerability by using a specially crafted message sequence, to force the IEC 61850 MMS-server communication stack, to stop accepting new MMS-client connections...

WAGO PFC200 Series Improper Authentication (CVE-2018-5459)

An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker...

ABB CP600 HMI Download of Code Without Integrity Check (CVE-2019-7229)

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: Utilization of USB/SD Card to flash the device and Remote provisioning process via ABB Panel Builder 600 over FTP. Neither of these transmission methods implements any form of encryption...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8486)

Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling. This plugin only works with Tenable.ot. Please visit...

Wago PFC200 iocheckd service 'I/O-Check' cache Memory Corruption (CVE-2019-5185)

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1ea28 the extracted state value from the xml file is used as an...

ICS/OT Cybersecurity 2022 TXOne Annual Report Insights

This article gives an in-depth overview of TXOne’s insight report on ICS/OT cyber incidents...

Wago PFC100/PFC200 OS Command Injection (CVE-2020-12522)

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 750-81xx/xxx-xxx, Series PFC 200 750-82xx/xxx-xxx, Series Wago Touch Panel 600 Standard Line 762-4xxx, Series Wago Touch Panel 600 Advanced Line...

Wago Multiple Products Missing Authentication for Critical Function (CVE-2022-3738)

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull. This...

Ransomware gunning for transport sector's OT systems next

ENISA the European Union Agency for Cybersecurity has reason to believe that ransomware gangs will begin targeting transportation operational technology OT systems in the foreseeable future. This finding is further explored in the agency's 50-page report entitled ENISA Threat Landscape: Transport...

Tridium Niagara Improper Authorization (CVE-2019-13528)

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10. This plugin only works with Tenable.ot. Please visit...

Leverage cloud-powered security with Microsoft Defender for IoT

Traditionally, operational technology OT and IT have occupied separate sides of enterprise security. But with digital transformation and the advent of Industry 4.0, the old, siloed approach is showing its age.1 The rise of manufacturing execution systems has enabled more “smart factories” to...

Leverage cloud-powered security with Microsoft Defender for IoT

Traditionally, operational technology OT and IT have occupied separate sides of enterprise security. But with digital transformation and the advent of Industry 4.0, the old, siloed approach is showing its age.1 The rise of manufacturing execution systems has enabled more “smart factories” to...

Fedora 38 : cairo / freetype / harfbuzz / qt6-qtwebengine (2023-a48406ecd2)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-a48406ecd2 advisory. Security fix for CVE-2023-25193 Update of HarfBuzz to 7.0.1 version 2169172 Update of freetype to 2.13.0 version 2168496 ---- Security fix for...

OSV-2023-170 Invalid-free in hb_free_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56952 Crash type: Invalid-free Crash state: hbfreeimpl OT::glyf::freecompiledsubsetglyphs OT::glyf::populatesubsetglyphs...

OSV-2023-160 Global-buffer-overflow in OT::gvar::accelerator_t::apply_deltas_to_points

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56800 Crash type: Global-buffer-overflow READ 2 Crash state: OT::gvar::acceleratort::applydeltastopoints bool OT::glyfimpl::Glyph::getpoints bool OT::glyfimpl::Glyph::getpoints...