Design/Logic Flaw

Unprotected transport of credentials vulnerability in IDEC PLCs FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier allows...

Spoofing

Plaintext storage of a password vulnerability in IDEC PLCs FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier allows an...

CVE-2021-20827

CVE-2021-20827 describes plaintext storage of a password vulnerability in IDEC PLCs, allowing an attacker to obtain PLC Web server credentials from SD cards (ZLD files) or file backups and potentially hijack the PLC. Affected products and versions include IDEC FC6A/MICROSmart All-in-One CPU Modul...

CVE-2021-20826

CVE-2021-20826 affects IDEC PLCs: FC6A/MICROSmart All-in-One CPU Module (v2.32 and earlier), FC6A/MICROSmart Plus (v1.91 and earlier), WindLDR (v8.19.1 and earlier), WindEDIT Lite (v1.3.1 and earlier), and Data File Manager (v2.12.1 and earlier). Root cause: unprotected transport of credentials (...

CVE-2021-20826

Unprotected transport of credentials vulnerability in IDEC PLCs FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier allows...

CVE-2021-20827: Cleartext Storage of Sensitive Information

Plaintext storage of a password vulnerability in IDEC PLCs FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier allows an...

CVE-2021-20826: Insufficiently Protected Credentials

Unprotected transport of credentials vulnerability in IDEC PLCs FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier allows...

CVE-2021-34578

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

Authentication flaw

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

CVE-2021-34578

CVE-2021-34578 affects WAGO PLCs (e.g., firmware versions up to FW07) where an authentication issue in the WBM allows an attacker with access to read and write device settings by sending specially crafted requests. The vulnerability arises from improper authentication/authorization of settings-pa...

CVE-2021-34578: Improper Authentication

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07...

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium lies in errors related to register data manipulation, allowing attackers to execute arbitrary commands.

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium is related to errors in controlling registration data. Exploiting this vulnerability allows an attacker to execute arbitrary commands usi...

Industrial Networks Exposed Through Cloud OT

The benefits of using a cloud-based management platform to monitor and configure industrial control systems ICS devices are obvious — efficiency, cost-savings and better diagnostics just for starters. But new research found critical vulnerabilities in these platforms that could be used to paralyz...

Unpatched, Critical RCE Bug Allows Utility Takeovers

A critical remote code-execution RCE vulnerability in Schneider Electric programmable logic controllers PLCs has come to light, which allows unauthenticated cyberattackers to gain root-level control over PLCs used in manufacturing, building automation, healthcare and enterprise environments. If...

A New Bug in Siemens PLCs Could Let Hackers Run Malicious Code Remotely

Siemens on Friday shipped firmware updates to address a severe vulnerability in SIMATIC S7-1200 and S7-1500 programmable logic controllers PLCs that could be exploited by a malicious actor to remotely gain access to protected areas of the memory and achieve unrestricted and undetected code...

Siemens SCALANCE XM-400 and XR-500 Devices Denial of Service Vulnerability

SCALANCE X switches are used to connect industrial components such as programmable logic controllers PLCs or human machine interfaces HMIs. A denial of service vulnerability exists in the Siemens SCALANCE XM-400 and XR-500 Devices, which can be exploited by an attacker to create a permanent denia...

The vulnerability of the microprogrammed software of Schneider Electric’s Modicon M340 programmable logic controllers stems from insufficient validation of input data. This allows a intruder to trigger malfunctions during maintenance operations.

The vulnerability of the microprogramming software of Schneider Electric’s Modicon M340 programmable logic controllers is related to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by sending a specially...

Design/Logic Flaw

A vulnerability has been identified in LOGO! 12/24RCE All versions, LOGO! 12/24RCEo All versions, LOGO! 230RCE All versions, LOGO! 230RCEo All versions, LOGO! 24CE All versions, LOGO! 24CEo All versions, LOGO! 24RCE All versions, LOGO! 24RCEo All versions, SIPLUS LOGO! 12/24RCE All versions, SIPL...

CVE-2020-16850

CVE-2020-16850 affects Mitsubishi Electric MELSEC iQ-R Series PLCs (firmware 49) and is caused by improper input validation. A crafted network packet can cause an unauthenticated remote DoS, halting the industrial process and requiring physical access to recover the device state. Documented affec...

CVE-2020-16850: Improper Input Validation

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to...