CVE-2019-14929

CVE-2019-14929 affects Mitsubishi Electric Europe B.V. smartRTU ME-RTU devices (firmware up to 2.02) and INEA ME-RTU devices (up to 3.0). The root cause is unprotected storage of credentials (passwords stored in plaintext) due to weak credential management, enabling an unauthenticated attacker to...

CVE-2019-14929

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management ...

CVE-2019-14930

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. Also, the accounts ineaadmin...

CVE-2019-14930

CVE-2019-14930 affects Mitsubishi Electric Europe B.V. ME-RTU (through 2.02) and INEA ME-RTU (through 3.0). The issue arises from undocumented hard-coded credentials for root, ineaadmin, mitsadmin, and maint, enabling unauthenticated access to the RTU. Additionally, ineaadmin and mitsadmin can es...

CVE-2019-14926

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with...

CVE-2019-14926

CVE-2019-14926 concerns hard-coded SSH keys in Mitsubishi Electric ME-RTU (firmware up to 2.02) and INEA ME-RTU (up to 3.0). The root cause is static private-key values stored in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key that are publicly available from...

CVE-2019-14928

The CVE-2019-14928 issue affects Mitsubishi Electric Europe B.V. ME-RTU devices up to firmware 2.02 and INEA ME-RTU devices up to 3.0, with stored cross-site scripting (XSS) vulnerabilities in the web interface. The vulnerability arises from insufficient input validation, e.g., the SerialInitialM...

CVE-2019-14928

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script XSS vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to...

CVE-2019-14927

The CVE-2019-14927 vulnerability affects Mitsubishi Electric Europe B.V. ME-RTU (versions up to 2.02) and INEA ME-RTU (up to 3.0), enabling an unauthenticated remote download of the device’s configuration file containing usernames, passwords, and other sensitive RTU data. This is an unauthenticat...

CVE-2019-14927

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's configuration file which contains data such as usernames,...

CVE-2019-14931

CVE-2019-14931 describes an unauthenticated remote OS command injection in Mitsubishi Electric ME-RTU (firmware ≤2.02) and INEA ME-RTU (≤3.0), exploitable via unsafe data in the Mobile Connection Test host parameter (shell command separator ';'). Impact is remote command execution with high sever...

CVE-2019-14931

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to t...

PT-2019-13867 · Mitsubishi · Me-Rtu

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier INEA ME-RTU devices versions 3.0 and earlier Description: An issue allows an attacker to read sensitive configuration settings due to insecure permission assignment. The...

PT-2019-13870 · Mitsubishi · Me-Rtu

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier INEA ME-RTU devices versions 3.0 and earlier Description: An issue allows an attacker to inject malicious code directly into the application through stored cross-site...

PT-2019-13868 · Inea · Me-Rtu

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier INEA ME-RTU devices versions 3.0 and earlier Description: An issue allows an attacker to gain unauthorized access or disclose encrypted data on the RTU due to hard-coded...

Schneider Electric BMXNOR0200H Ethernet/Serial RTU Module Access Control Error Vulnerability

The Schneider Electric BMXNOR0200H Ethernet/Serial RTU module is an Ethernet Serial RTU Remote Terminal Unit module from Schneider Electric, France. An access control error vulnerability exists in the Schneider Electric BMXNOR0200H Ethernet/Serial RTU module. The vulnerability arises from the...

CVE-2019-6810

CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module all firmware versions, which could cause the execution of commands by unauthorized users when using IEC 60870-5-104 protocol...

Improper access control

CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module all firmware versions, which could cause the execution of commands by unauthorized users when using IEC 60870-5-104 protocol...

Design/Logic Flaw

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module all firmware versions, which could cause disconnection of active connections when an unusually high number of IEC 60870- 5-104 packets are received by the module on por...

CVE-2019-6813

The CVE-2019-6813 vulnerability affects Schneider Electric BMXNOR0200H Ethernet/Serial RTU modules and Modicon M340 controllers (all firmware versions). It is a CWE-754 improper check for unusual or exceptional conditions that could cause a denial of service when truncated SNMP packets are receiv...