The vulnerability of the software products for developing HMI/SCADA systems such as EcoStruxure Machine SCADA Expert and Pro-face BLUE Open Studio lies in the ability to restore unreliable data from memory, allowing an attacker to execute arbitrary code.

The vulnerability of the software products for developing HMI/SCADA systems such as EcoStruxure Machine SCADA Expert and Pro-face BLUE Open Studio lies in the ability to restore unreliable data in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2022-4770 · Schneider Electric +1 · Ecostruxure Machine Scada Expert +1

Name of the Vulnerable Software and Affected Versions: EcoStruxure Machine SCADA Expert affected versions not specified Pro-face BLUE Open Studio affected versions not specified Description: The issue is related to the restoration of invalid data in memory, which could allow an attacker to execut...

Hacktivist Group GhostSec Compromises 55 Berghof PLCs Across Israel

A hacktivist collective called GhostSec has claimed credit for compromising as many as 55 Berghof programmable logic controllers PLCs used by Israeli organizations as part of a "Free Palestine" campaign. Industrial cybersecurity firm OTORIO, which dug deeper into the incident, said the breach was...

The vulnerability of the ActiveX control on the SCADA server of Measuresoft ScadaPro Server allows a intruder to execute arbitrary code.

The vulnerability of the ActiveX control in the SCADA server of Measuresoft ScadaPro Server is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the ActiveX control on SCADA servers of Measuresoft ScadaPro Server and ScadaPro Server Client allows attackers to enhance their privileges.

The vulnerability of the ActiveX control used by SCADA servers of Measuresoft ScadaPro Server and ScadaPro Server Client is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

PT-2022-6544 · Scada-Lts · Scada-Lts

Name of the Vulnerable Software and Affected Versions: Scada-LTS version 2.7.1.1 build 2948559113 Description: A privilege escalation issue was discovered that allows remote attackers, authenticated in the application as a low-privileged user, to change their role, for example, to administrator, ...

The vulnerability of the ActiveX control on the SCADA server of Measuresoft ScadaPro Server allows a intruder to execute arbitrary code.

The vulnerability of the ActiveX control in the SCADA server of Measuresoft ScadaPro Server relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the target system using a specially crafted file...

PT-2022-4635 · Measuresoft · Measuresoft Scadapro Server

Name of the Vulnerable Software and Affected Versions: Measuresoft ScadaPro Server All Versions Description: The issue is related to a use-after-free condition when processing a specific project file, which can allow an attacker to execute arbitrary code remotely. This is associated with the...

Measuresoft ScadaPro Server and Client 安全漏洞

Measuresoft ScadaPro Server and Client is a powerful real-time data acquisition software package from Measuresoft Ireland. It provides monitoring, data logging, simulation development and report generation. A security vulnerability exists in Measuresoft ScadaPro Server and Client, which stems fro...

The vulnerability of the AVEVA Edge SCADA system, related to incorrect restrictions on XML references to external objects, allows a intruder to trigger a service failure or gain unauthorized access to confidential data.

The vulnerability of the AVEVA Edge SCADA system is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow an attacker to trigger service failures or gain unauthorized access to confidential data...

The vulnerability of the AVEVA Edge SCADA system, related to the uncontrolled element in the search process, allows a intruder to execute arbitrary commands or increase their privileges.

The vulnerability of the AVEVA Edge SCADA system is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow a hacker to execute arbitrary code or increase their privileges...

Industrial systems: What it takes to secure and staff them

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Patrick C. Miller,...

ICONICS Suite and Mitsubishi Electric MC Works64 Products (Update C)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Low attack complexity Vendors: ICONICS, Mitsubishi Electric Equipment: ICONICS Product Suite, MC Works64 Vulnerabilities: Path Traversal, Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere, Out-of-Bounds Read 2...

ICONICS GENESIS64 Path Traversal Vulnerability

ICONICS GENESIS64 is a suite of advanced HMI SCADA solutions designed for Microsoft operating systems from ICONICS, Inc. A path traversal vulnerability exists in ICONICS GENESIS64 versions 10.97 and 10.97.1, which allows a remote, unauthenticated attacker to access arbitrary files in the GENESIS6...

Mitsubishi Electric MC Works64 代码问题漏洞

Mitsubishi Electric MC Works64 is a data acquisition and monitoring system SCADA from Mitsubishi Electric Japan. A code issue vulnerability exists in Mitsubishi Electric MC Works64 that stems from incorrect validation of inputs to the project configuration file...

Inductive Automation Ignition授权问题漏洞

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA Data Acquisition and Monitoring Systems, HMI Human Machine Interface and more. Inductive Automation Ignition suffers from an authorization issue...

PT-2022-5035 · Hitachi Energy · Hitachi Energy Microscada X Sys600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MicroSCADA X SYS600 versions 10.2 through 10.3.1 Description: The issue is related to an Improper Input Validation vulnerability in the ICCP stack of Hitachi Energy MicroSCADA X SYS600. This vulnerability can cause a...

Distributed Data Systems WebHmi 操作系统命令注入漏洞

Distributed Data Systems WebHmi is a Scada system with a built-in web server from Distributed Data Systems, Ukraine. It is used to monitor and control any automation system on a local network and over the Internet from computers and mobile devices. An operating system command injection...

Schneider Electric Geo SCADA Mobile Information Disclosure Vulnerability

Schneider Electric Geo SCADA Mobile is a mobile extension from Schneider Electric, a French company. It provides real-time remote access to critical SCADA data, allowing system users to monitor performance while "on the go," increasing employee productivity and improving overall system performanc...

The vulnerability of the remote monitoring and control system Geo SCADA Mobile (previously known as ClearSCADA Mobile) stems from deficiencies in the system’s boundary definitions. This allows attackers to compromise the integrity, accessibility, and confidentiality of the protected information.

The vulnerability of the remote monitoring and control system Geo SCADA Mobile previously known as ClearSCADA Mobile is related to deficiencies in the system’s boundary settings. Exploiting this vulnerability allows an attacker to compromise the integrity, accessibility, and confidentiality of th...