Memory corruption

An attacker with network access to the affected PLC CJ-series and CS-series PLCs, all versions may use a network protocol to read and write files on the PLC internal memory and memory card...

CVE-2022-45794

CVE-2022-45794 affects Omron CS/CJ Series PLCs (CJ-series and CS-series, all versions). The underlying issue is missing authentication for a critical function, enabling a remote attacker with network access to read/write files on the PLC internal memory and memory card via the network protocol. D...

CVE-2022-45794 Omron CJ-series and CS-series unauthenticated filesystem access.

An attacker with network access to the affected PLC CJ-series and CS-series PLCs, all versions may use a network protocol to read and write files on the PLC internal memory and memory card...

CVE-2023-46143 Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC...

Unitronics Vision and Samba Series (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor : Unitronics Equipment : Vision Series, Samba Series Vulnerability : Initialization of a Resource with an Insecure Default 2. RISK...

Unitronics Vision PLC and HMI Insecure Default Password Vulnerability

Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands...

CISA and Partners Release Joint Advisory on IRGC-Affiliated Cyber Actors Exploiting PLCs

Today, CISA, the Federal Bureau of Investigation FBI, National Security Agency NSA, Environmental Protection Agency EPA, and the Israel National Cyber Directorate INCD released a joint Cybersecurity Advisory CSA IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors in response to the acti...

Iranian Hackers Exploit PLCs in Attack on Water Authority in U.S.

The U.S. Cybersecurity and Infrastructure Security Agency CISA revealed that it's responding to a cyber attack that involved the active exploitation of Unitronics programmable logic controllers PLCs to target the Municipal Water Authority of Aliquippa in western Pennsylvania. The attack has been...

ICS-Forensics-Tools - Microsoft ICS Forensics Framework

Microsoft ICS Forensics Tools is an open source forensic framework for analyzing Industrial PLC metadata and project files. it enables investigators to identify suspicious artifacts on ICS environment for detection of compromised devices during incident response or manual check. open source...

Default credentials

Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card .PRG file ending...

CVE-2023-43776 Weak encoding vulnerability in easyE4

Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card .PRG file ending...

CVE-2023-43776 Weak encoding vulnerability in easyE4

Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card .PRG file ending...

CVE-2023-43776

CVE-2023-43776 affects Eaton easyE4 PLC. Affected component: device password protection storage in easyE4, where the device password is stored using a weak encoding algorithm in program files exported as *.PRG on SD card. Evidence from multiple sources identifies this weakness as the vulnerabilit...

Eaton easyE4 PLC Encryption Issue Vulnerability

The Eaton easyE4 PLC is a PLC from Eaton Corporation USA. A security vulnerability exists in the Eaton easyE4 PLC that stems from a weakly encoded algorithm used to store device passwords in program files...

CVE-2023-5459

A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used...

Design/Logic Flaw

A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used...

CVE-2023-5459 Delta Electronics DVP32ES2 PLC Password Transmission denial of service

A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used...

CVE-2023-5459

CVE-2023-5459 affects Delta Electronics DVP32ES2 PLC version 1.48. The Password Transmission Handler component is manipulable, leading to denial of service. Public exploit/disclosure acknowledged; vendor not responding. Public fix status is not provided in the documents; one PT-Security entry not...

CVE-2023-5459 Delta Electronics DVP32ES2 PLC Password Transmission denial of service

A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used...

XINJE XD5E-30R-E Security Breach

The XINJE XD5E-30R-E is an Ethernet PLC from China XINJE. A security vulnerability exists in the XINJE XD5E-30R-E version 3.5.3b. An attacker could exploit this vulnerability to cause a denial of service on the system...