Schneider Electric Modicon M221 Information Management Errors (CVE-2018-7790)

An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a...

Schneider Electric Modicon M221 Programmable Logic Controller Missing Encryption of Sensitive Data (CVE-2020-7567)

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke t...

Wago PLC Cycle Time Influences Uncontrolled Resource Consumption (CVE-2019-10953)

ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets. This plugin only works with Tenable.ot. Please visit...

Osprey Pump Controller 1.0.1 Cross Site Scripting

Osprey Pump Controller 1.0.1 Unauthenticated Reflected XSS Vendor: ProPump and Controls, Inc. Product web page: https://www.propumpservice.com | https://www.pumpstationparts.com Affected version: Software Build ID 20211018, Production 10/18/2021 Mirage App: MirageAppManager, Release 1.0.1 Mirage...

Osprey Pump Controller 1.0.1 Unauthenticated Remote Code Execution Exploit

Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability

LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC Korea. LS ELECTRIC XBC-DN32U version 01.80 is vulnerable to an access control error, which could be exploited to remotely set the function to lock out the user from reading data from the device...

LS ELECTRIC XBC-DN32U Information Disclosure Vulnerability

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An information disclosure vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which originates when the device transmits sensitive information in clear text when communicating via the XGT...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21677)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80. The vulnerability stems from the device's inability to properly control access to the PLC via its internal XGT...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21680)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication for the PLC to perform critical functions and can be exploited by an...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21679)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An access control error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication for the delete command and can be exploited by an attacker to delete...

LS ELECTRIC XBC-DN32U Denial of Service Vulnerability

LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC Korea.A denial of service vulnerability exists in the LS ELECTRIC XBC-DN32U. The vulnerability stems from the fact that the device will stop functioning when accessing a memory location outside of the communication...

LS ELECTRIC XBC-DN32U Access Control Error Vulnerability (CNVD-2023-21678)

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication of the PLC's created user, and can be exploited by an attacker to create a...

CVE-2023-22807

LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol...

CVE-2023-22804

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...

CVE-2023-22803

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily...

Authentication flaw

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily...

Design/Logic Flaw

LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol...

CVE-2023-22807 CVE-2023-22807

LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol...

CVE-2023-22807

LS ELECTRIC XBC-DN32U (OS version 01.80) has an improper access control vulnerability in the XGT protocol that could allow an attacker to control and tamper with the PLC by sending packets over XGT. This CVE (CVE-2023-22807) is part of a broader set affecting XBC-DN32U and related CVEs (e.g., 228...

CVE-2023-22804

LS ELECTRIC XBC-DN32U with OS version 01.80 has a vulnerability (CVE-2023-22804) where authentication is missing for creating PLC users. This could let an attacker create an account with elevated privileges and take control of the device. Exploitation details are not provided in the documents, bu...