CVE-2018-7242

Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks...

CVE-2018-7760

An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions allow malicious users to bypass authorization...

CVE-2018-7761

A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbitrary code execution...

CVE-2018-7240

CVE-2018-7240 affects Schneider Electric Modicon Premium, Quantum, M340, and BMXNOR0200 series controllers. The vulnerability is a stack-based buffer overflow in the FTP server used for firmware upgrades, which could allow arbitrary code execution or, in extreme cases, malicious firmware loading ...

CVE-2018-7241

CVE-2018-7241 affects Schneider Electric Modicon Premium, Quantum, M340, and BMXNOR0200 controllers. The issue is hard-coded accounts present in all versions of the devices’ communication modules, enabling unauthorized access via the FTP/communication interfaces. The underlying risk is high (desc...

CVE-2018-7759

CVE-2018-7759 describes a buffer overflow in Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200 caused by using the length of the source string (not the buffer size) as the copy size. This vulnerability can enable a remote attacker to cause a denial of service. A vendor advisor...

CVE-2018-7760

Affected products: Schneider Electric Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Vulnerability: authorization bypass in CGI functions of the embedded web server, allowing remote attackers to bypass authentication. Root cause: authentication mechanism weaknesses in CGI handlin...

CVE-2018-7762

A vulnerability in Schneider Electric’s Modicon M340, Modicon Premium, and Modicon Quantum PLCs (BMXNOR0200) affects the web services that process SOAP requests, where an input handling flaw could trigger a buffer overflow. This could cause a denial of service. Public details point to a buffer-ov...

Dr. Michio Kaku Paints Fascinating Picture of the Future at Qualys’ RSA Booth

Contact lenses that access the Internet literally at the blink of an eye. Toilets that detect cancer-indicating enzymes. Human settlements on Mars. Beaming one’s mind into outer space using lasers. Watching a video of your dreams after you wake up. Those were just a few of the mind-blowing...

Lutron Quantum 2.0 - 3.2.243 - Information Disclosure Exploit

Exploit for hardware platform in category web applications ''' Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

Lutron Quantum 2.0 - 3.2.243 - Information Disclosure

Lutron Quantum 2.0 - 3.2.243 - Information Disclosure ''' Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

CVE-2018-7240: Out-of-bounds Write

A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP command used to upgrade the firmware of the module can be misused to cause a denial of service, or in extreme cases, to load a malicious...

CVE-2018-7242: Inadequate Encryption Strength

Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks...

CVE-2018-7241: Use of Hard-coded Credentials

Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules...

CVE-2018-7760: Improper Authentication

An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions allow malicious users to bypass authorization...

CVE-2018-7761: Improper Input Validation

A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbitrary code execution...

CVE-2018-7762: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow result in a buffer overflow...

CVE-2018-7759: Improper Restriction of Operations within the Bounds of a Memory Buffer

A buffer overflow vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. The buffer overflow vulnerability is caused by the length of the source string specified instead of the buffer size as the number of bytes to be copied...

Lutron Quantum 2.0 - 3.2.243 - Information Disclosure

''' Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

Investing in the right innovation

RSA is around the corner which means tens of thousands of people will descend on Moscone Center in San Francisco, CA. Hundreds of innovative young companies will look for customers, props, and capital especially at the Early Stage Expo!. Venture capitalists will look for opportunities to invest a...