Hardcoded credentials

The password for the safety PLC is the default and thus easy to find in manuals, etc.. This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the las...

CVE-2020-10276

CVE-2020-10276 involves improper access control due to default passwords on the SICK safety PLC in MiR robots. The MiR 2.x line ships with insecure default credentials, which could allow an attacker on the internal network to manipulate the safety PLC and disable the emergency stop, potentially e...

CVE-2020-10276 RVD#2558: Default credentials on SICK PLC allows disabling safety features

The password for the safety PLC is the default and thus easy to find in manuals, etc.. This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the las...

Honeywell ControlEdge PLC and RTU

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Honeywell Equipment: ControlEdge PLC and RTU Vulnerabilities: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

Vulnerability Spotlight: Multiple vulnerabilities in Siemens LOGO! PLC

Alexander Perez-Palma of Cisco Talos and Emanuel Almeida of Cisco Systems discovered these vulnerabilities. Blog by Jon Munshaw. Cisco researchers recently discovered several vulnerabilities in the Siemens LOGO! PLC. The LOGO! allows users to control various automation projects, such as industria...

Denial of Service Vulnerability in Proficy Machine Edition (CNVD-2020-32607)

Proficy Machine Edition is a PLC programming software developed by Emerson Trading Shanghai Co., Ltd. for designing, debugging, programming, and maintaining GE RX 3i and GE RX7i series PLCs, which is widely used in industrial control fields such as electric power, machinery manufacturing, steel,...

CVE-2020-6081

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

Command Execution Vulnerability in WideField2

WideField2 is a PLC programming software developed by Yokogawa Electric Group. WideField2 suffers from a command execution vulnerability that can be exploited by an attacker to gain server privileges...

Denial of Service Vulnerability in Control Expert

Control Expert formerly known as Unity Pro is a PLC configuration software from Schneider, through which you can complete the PLC program writing as well as down loading operations. A denial of service vulnerability exists in Control Expert, which can be exploited by an attacker to cause a denial...

CVE-2020-10245

CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. Recent assessments: zeroSteiner at May 07, 2020 9:03pm UTC reported: The following analysis is based on CODESYS 3.5.15.20: Installer file: CODESYS 3.5.15.20.exe, SHA-1...

Unspecified Vulnerability in WAGO PFC100 and WAGO PFC 200 (CNVD-2020-17497)

The WAGO PFC 200 and WAGO PFC 100 are both programmable logic controllers PLCs from WAGO Germany. A security vulnerability exists in the Web-Based Management web application in the WAGO PFC 200 with firmware versions 03.00.3912 and 03.01.0713 and the PFC100 with firmware version 03.00.3912. The...

CVE-2020-6986

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

Design/Logic Flaw

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

CVE-2020-6986

In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result...

CVE-2020-6986

CVE-2020-6986 affects Omron PLC CJ Series (all versions). The vulnerability is described as Uncontrolled Resource Consumption (CWE-400) where an attacker can send a sequence of specific data packets in a short time, triggering a PLC Ethernet module error and resulting in a service-denied state. D...

Omron PLC CJ Series

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Omron Equipment: PLC CJ Series Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial-of-service condition. 3...

CVE-2019-20045

The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. Specially crafted malicious packets could cause disconnection of active authentic connections or reboot of device. This is a different issue than CVE-2019-16879 and...

CVE-2019-20046

The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not require adequate authentication, which may allow an attacker to read sensitive information or execute arbitrary code. This is a different issue...

Design/Logic Flaw

The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not require adequate authentication, which may allow an attacker to read sensitive information or execute arbitrary code. This is a different issue...

CVE-2019-20045

The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. Specially crafted malicious packets could cause disconnection of active authentic connections or reboot of device. This is a different issue than CVE-2019-16879 and...