CVE-2020-7538: Improper Check for Unusual or Exceptional Conditions

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request...

CVE-2020-7559: Buffer Copy without Checking Size of Input

A CWE-120: Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially...

CVE-2020-28212: Improper Restriction of Excessive Authentication Attempts

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when a brute force attack is done over Modbus...

CVE-2020-28211: Incorrect Authorization

A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause bypass of authentication when overwriting memory using a debugger...

PT-2020-6315

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert all versions Description A vulnerability exists in the PLC Simulator of EcoStruxure Control Expert software, related to improper check for unusual or exceptional conditions. This issue could cause a crash of the PLC...

PT-2020-6378

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert all versions Description A buffer copy without checking the size of input issue exists in the PLC Simulator of EcoStruxure Control Expert software. This could cause a crash of the PLC simulator when receiving a...

PT-2020-16947

Name of the Vulnerable Software and Affected Versions EcoStruxureª Control Expert now Unity Pro all versions Description A CWE-494: Download of Code Without Integrity Check issue exists in the PLC Simulator that could cause unauthorized command execution when sending specially crafted requests ov...

CVE-2020-28213: Download of Code Without Integrity Check

A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when sending specially crafted requests over Modbus...

Schneider Electric Unity Pro security vulnerabilities

Schneider Electric EcoStruxure Control Expert is the universal programming, commissioning and operating software for the Modicon M340, M580, M580S, Premium, Momentum and Quantum series. A command execution vulnerability exists in Schneider Electric EcoStruxure Control Expert. The vulnerability...

Schneider Electric EcoStruxure Control Expert authorization issue vulnerability

EcoStruxure Control Expert is the universal programming, debugging and operating software for the Modicon M340, M580, M580S, Premium, Momentum and Quantum series. A security vulnerability exists in PLC Simulator in EcoStruxure Control Expert. The vulnerability can be exploited by an attacker to...

Schneider Electric EcoStruxure Control Expert Security Vulnerability

Schneider Electric EcoStruxure Control Expert formerly known as Unity Pro is a suite of programming software for Schneider Electric logic controller products from Schneider Electric, France. A security vulnerability exists in EcoStruxure Control Expert that stems from a specially crafted request...

PT-2020-6316

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert all versions Description A vulnerability exists in the PLC Simulator of EcoStruxure Control Expert that could cause bypass of authentication when overwriting memory using a debugger. This issue is related to incorrec...

Vulnerability fixed in EcoStruxure Control Expert

A vulnerability has been fixed that could cause a crash of the PLC simulator in EcoStruxure Control Expert software when a specially crafted request is received via Modbus. Schneider Electric has made available a firmware update that fixes the vulnerability. For more information, see:...

Schneider Electric EcoStruxure Control Expert PLC Denial of Service Vulnerability

Schneider Electric EcoStruxure Control Expert formerly Unity Pro is a suite of programming software for Schneider Electric logic controller products from Schneider Electric, France. A denial of service vulnerability exists in EcoStruxure Control Expert's PLC simulator, which originates when a...

Schneider Electric PLC Simulator for EcoStruxure Control Expert

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: PLC Simulator for EcoStruxure Control Expert Vulnerability: Improper Check for Unusual or Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this...

Design/Logic Flaw

Visual Components owned by KUKA is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds ...

CVE-2020-10291 RVD#3336: System information disclosure without authentication on KUKA simulators

Visual Components owned by KUKA is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds ...

CVE-2020-10291

CVE-2020-10291 concerns Visual Components’ network license server used by KUKA simulators. The server binds UDP port 5093 on all interfaces without authentication, exposing sensitive system information via RMS Sentinel’s license protocol. The disclosed data includes hardware/OS characteristics an...

CVE-2020-10292

CVE-2020-10292 affects Visual Components (KUKA) network license server used by Visual Components software. The RMS Sentinel license manager listens on UDP 5093 and exposes sensitive system information without authentication. A DoS is possible via an arbitrary pointer dereference in the decrypted ...

ctf

This repository contains a writeup for the CSAW CTF 2015. The writeup includes descriptions of various challenges, including web, exploit, crypto, reversing, and forensics challenges. The writeup is organized into sections, with each section describing a specific challenge. The challenges include...