Schneider Electric Modicon M221 Programmable Logic Controller

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable from an adjacent network Vendor: Schneider Electric Equipment: Modicon M221 Programmable Logic Controller Vulnerabilities: Inadequate Encryption Strength, Small Space of Random Values, Missing Encryption of Sensitive Data, Exposure of...

The vulnerability of the core.arh component of the EKRA 200 microprocessor series allows a hacker to cause a system failure.

The vulnerability of the core.arh component of the microprogramming software for PLC ERCA is related to insufficient processing of input data during updates. Exploiting this vulnerability can allow a malicious actor to cause service failures using a specially crafted HEX/LDR file...

Denial of service

An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Programmable Logic Controller Systems Series B FRN 16.000, Series B FRN 15.002, Series B FRN 15.000, Series B FRN 14.000, Series B FRN 13.000, Series B FRN 12.000, Series B FRN 11.000...

CVE-2020-6111

CVE-2020-6111 affects Allen-Bradley MicroLogix 1100 PLCs (Series B FRNs 10.000–16.000). The root cause is improper handling of ICMP/IPv4 packets with invalid IPv4 length, triggering a major error that can crash the device and cause a denial-of-service (CWE-130). Reported CVSS v3 base score is 7.5...

CVE-2020-25181

WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution...

CVE-2020-25181

WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution...

CVE-2020-25177

WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution...

CVE-2020-25177

WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution...

Heap overflow

WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution...

Stack overflow

WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution...

CVE-2020-25181

WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution...

CVE-2020-25181

Affected product: WECON PLC Editor (Versions 1.3.8 and prior). CVE-2020-25181 is a heap-based buffer overflow in the WCP file parsing path that may lead to arbitrary code execution. ZDI advisories describe remote code execution requiring user interaction (visit a malicious page or open a maliciou...

CVE-2020-25177

CVE-2020-25177 affects WECON PLC Editor Versions 1.3.8 and prior. The vulnerability is a stack-based buffer overflow in WCP file parsing that may allow arbitrary code execution. ZDI describes it as remote code execution requiring user interaction via malicious WCP content, due to inadequate lengt...

CVE-2020-25177

WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution...

Input validation

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to...

CVE-2020-16850

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to...

Unspecified Vulnerability in Schneider Electric EcoStruxure Control Expert

EcoStruxure Control Expert is the universal programming, debugging and operating software for the Modicon M340, M580, M580S, Premium, Momentum and Quantum series. A security vulnerability exists in PLC Simulator in EcoStruxure Control Expert. The vulnerability can be exploited by an attacker to...

Schneider Electric EcoStruxure Control Expert Incorrect Authorization Vulnerability

Schneider Electric EcoStruxure Control Expert is the universal programming, commissioning and operating software for the Modicon M340, M580, M580S, Premium, Momentum and Quantum series. An incorrect authorization vulnerability exists in PLC Simulator in Schneider Electric EcoStruxure Control...

Schneider Electric EcoStruxure Control Expert Command Execution Vulnerability

Schneider Electric EcoStruxure Control Expert is the universal programming, commissioning and operating software for the Modicon M340, M580, M580S, Premium, Momentum and Quantum series. A command execution vulnerability exists in Schneider Electric EcoStruxure Control Expert. The vulnerability...

CVE-2020-7559

A CWE-120: Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially...