902 matches found
PT-2024-30295 · Automationdirect · Directlogic H2-Dm1E +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a session hijacking attack targeting the application layer's control mechanism. This mechanism manages authenticated sessions between...
CODESYS OSCAT Basic Library 缓冲区错误漏洞
CODESYS OSCAT Basic Library is an open source library from CODESYS Corporation, known as the Open Source Community for Automation Technology. A buffer error vulnerability exists in CODESYS OSCAT Basic Library versions prior to 3.3.5, which stems from the presence of an out-of-bounds read...
PT-2024-37920 · Unknown · Oscat Basic Library
Name of the Vulnerable Software and Affected Versions: OSCAT Basic Library affected versions not specified Description: The issue is an Out-of-Bounds read vulnerability that allows a local, unprivileged attacker to access limited internal data of the PLC, which may lead to a crash of the affected...
CVE-2024-41716
Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user credentials of the PLC or Operator Interfaces. As a result, an attacker may be able to manipulate...
Allen-Bradley's Legacy Protocol (PCCC) Denial Of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "DoS Exploitation of Allen-Bradley's Legacy Protocol PCCC", 'Description' = %q A remote, unauthenticated attacker could send a single, specially...
WindLDR and WindO/I-NV4 store sensitive information in cleartext
Overview PLC programming software "WindLDR" and Operator Interfaces' Touchscreen Programming Software "WindO/I-NV4" provided by IDEC Corporation store sensitive information in cleartext form CWE-312. Yuki Meguro of Toinx Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the...
CVE-2024-23908
Insecure inherited permissions in some Flexlm License Daemons for IntelR FPGA software before version v11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access...
The vulnerability of microprogrammed logic controllers from Unitronics Vision PLC, related to incorrect handling of exceptional states, allows a intruder to trigger a malfunction in maintenance operations.
The vulnerability of microprogrammed logic controllers from Unitronics Vision PLC lies in the improper handling of exceptional states. Exploiting this vulnerability can allow an attacker to cause malfunctions in the system remotely...
The vulnerability of the access control mechanism in Siemens LOGO programmable logic controllers allows a intruder to execute arbitrary commands.
The vulnerability of the access control mechanism in Siemens LOGO programmable logic controllers is related to the absence of authentication for critical functions. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
The vulnerability of microprogrammed software in programmable logic controllers such as ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, CompactLogix 5480, CompactGuardLogix 5380, and 1756-EN4TR lies in insufficient validation of input data. This allows a malicious actor to trigger malfunctions during maintenance operations.
The vulnerability of microprogrammed software in programmable logic controllers such as ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, CompactLogix 5480, Compact GuardLogix 5380, and 1756-EN4TR is related to insufficient validation of input data. Exploiting this vulnerability can allow an...
Siemens S7-200 SMART series uses unsafe random value vulnerability
The S7-200 SMART series is a series of miniature programmable logic controllers that control a variety of small automation applications. A use of insecure random values vulnerability exists in the Siemens S7-200 SMART series, which can be exploited by an attacker to create a denial of service...
Siemens SIMATIC S7-200 SMART Devices
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
The vulnerability of the application software interface of the microprogramming system for programmable logic controllers AutomationDirect P3-550E allows a intruder to trigger a service failure.
The vulnerability of the application software interface for Microprogramming Systems, AutomationDirect P3-550E, is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the application software interface of the microprogramming system for programmable logic controllers AutomationDirect P3-550E allows a intruder to trigger a service failure.
The vulnerability of the application software interface for Microprogramming Systems, AutomationDirect P3-550E, is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the application software interface of the microprogramming system for programmable logic controllers AutomationDirect P3-550E allows a intruder to trigger a service failure.
The vulnerability of the application software interface for Microprogramming Systems, AutomationDirect P3-550E, is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the CurrDir component in the microprogramming software for programmable logic controllers AutomationDirect P3-550E allows a intruder to trigger a service failure.
The vulnerability of the CurrDir component in the AutomationDirect P3-550E programmable logic controllers is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure remotely...
Exposed and vulnerable: Recent attacks highlight critical need to protect internet-exposed OT devices
Since late 2023, Microsoft has observed an increase in reports of attacks focusing on internet-exposed, poorly secured operational technology OT devices. Internet-exposed OT equipment in water and wastewater systems WWS in the US were targeted in multiple attacks over the past months by different...
AutomationDirect P3-550E Access Control Error Vulnerability
The AutomationDirect P3-550E is a programmable control system PLC from AutomationDirect USA. An access control error vulnerability exists in AutomationDirect P3-550E version 1.2.10.9, which can be exploited by an attacker to cause arbitrary writes by sending specially crafted network packets...
AutomationDirect P3-550E Out-of-Bounds Write Vulnerability
The AutomationDirect P3-550E is a programmable control system PLC from AutomationDirect USA. An out-of-bounds write vulnerability exists in AutomationDirect P3-550E version 1.2.10.9, which can be exploited by an attacker to cause a denial of service via specially crafted network packets...
kernel: x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
In the Linux kernel, the following vulnerability has been resolved: x86/i8259: Mark legacy PIC interrupts with IRQLEVEL Baoquan reported that after triggering a crash the subsequent crash-kernel fails to boot about half of the time. It triggers a NULL pointer dereference in the periodic tick code...