Design/Logic Flaw

Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a later upstream version: kernel 4.18.0. BZ2036888 Security Fixes: kernel: improper initialization of the "flags" member of the new pipebuffer CVE-2022-0847 kernel: U...

Authentication bypass vulnerability in several Schneider Electric products

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network devices. Schneider Electric...

Authentication Error Vulnerability in Various Schneider Electric Products

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. The Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network equipment. The Schneide...

CVE-2022-0715

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series SMT Series ID=18: UPS 09.8 and prior / SMT Series...

CVE-2022-22806

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series SMT Series ID=1015: UPS 04.5 and prior, SMC Series SMC Series ID=1018: UPS 04.2...

CVE-2022-0715

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series SMT Series ID=18: UPS 09.8 and prior / SMT Series...

Multiple Schneider Electric products have vulnerabilities related to data falsification.

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. The Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network equipment. The Schneide...

Vulnerabilities fixed in APC UPS systems

Vulnerabilities have been fixed in Uninterruptible Power Supply UPS systems from APC. APC is part of Schneider Electric. These UPS systems are widely used in situations where up-time is very important. The vulnerabilities with reference CVE-2022-22805 and CVE-2022-22806 allow a remote malicious...

Siemens RUGGEDCOM Devices Information Disclosure Vulnerability

RUGGEDCOM ROS-based devices are typically switches and serial-to-Ethernet devices used to connect equipment that operates in harsh environments, such as electric utility substations and traffic control cabinets. An information disclosure vulnerability exists in Siemens RUGGEDCOM Devices, which ca...

Schneider Electric’s multiple products have buffer error vulnerabilities

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network devices. Schneider Electric...

Schneider Electric’s multiple products have vulnerabilities related to authorization issues

The Schneider Electric APC Smart-UPS SMC Series, among others, is a product of Schneider Electric, a French company. Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point-of-sale, routers, switches, hubs and other network devices. Schneider Electric...

CVE-2022-26131

CVE-2022-26131 affects Power Line Communications PLC4TRUCKS J2497 (PLC) trailer receivers. Technical details in connected docs show Improper Protection against Electromagnetic Fault Injection (CWE-1319) with a CVSSv3 base score of 9.3, and related Missing Authentication for Critical Function (CWE...

CVE-2022-26131 ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497

Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals...

CVE-2022-26131 ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497

Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals...

CVE-2022-25922

CVE-2022-25922 affects the Power Line Communications PLC4TRUCKS J2497 trailer brake controllers, where diagnostic functions can be invoked by replaying J2497 messages due to missing authentication/authorization for critical functions. This allows a remote attacker on the network/vehicle bus to tr...

CVE-2022-25922 ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497

Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions...

CVE-2022-25922 ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497

Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions...

CVE-2022-25597

ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service...

CVE-2022-26131: Improper Protection against Electromagnetic Fault Injection (EM-FI)

Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals...