Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2022-2585)

A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system. This plugin only works...

Siemens SIMATIC Devices Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-2022-42329)

Guests can trigger deadlock in Linux netback drive. The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling CVE-2022-42328. Additionally when dropping packages for other reasons the same deadlock...

Siemens SIMATIC Devices Linux Kernel Authentication Bypass by Primary Weakness (CVE-2022-21505)

A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel lockdown was enabled This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc';...

Siemens SIMATIC Devices Linux Kernel NULL Pointer Dereference (CVE-2022-3606)

A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function findprogbysecinsn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The...

Siemens SIMATIC and SCALANCE Devices Use After Free (CVE-2023-4921)

A use-after-free vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfqdequeue due to the incorrect .peek handler of...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Double Free (CVE-2022-2588)

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service system crash or execute arbitrary code. This...

Siemens SCALANCE W700 Integer Overflow or Wraparound (CVE-2022-39842)

An issue was discovered in the Linux kernel before 5.19. In pxa3xxgcuwrite in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of sizet versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to...

Siemens SCALANCE W700 Permissive List of Allowed Inputs (CVE-2023-7250)

A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection...

Dahua Security Digital Video Recorders Credentials Management Errors (CVE-2013-3612)

Dahua DVR appliances have a hardcoded password for 1 the root account and 2 an unspecified backdoor account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving a ActiveX, b a standalone client, or c unknown other vectors. This plugin on...

Elspec G5 Digital Fault Recorder Improper Handling of Insufficient Permissions or Privileges (CVE-2024-22077)

An issue was discovered in Elspec G5 digital fault recorder. The SQLite database file has weak permissions. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if descriptio...

Elspec G5 Digital Fault Recorder VsFTPd Service Denial of Service (CVE-2021-30047)

Outdated vsftpd service with known DoS issue. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid502820; scriptversion"1.2";...

Elspec G5 Digital Fault Recorder Improper Restriction of XML External Entity Reference (CVE-2024-46603)

An issue was discovered in Elspec G5 digital fault recorder. An XML External Entity XXE vulnerability may allow an attacker to cause a Denial of Service DoS via a crafted XML payload. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Cisco Products Uncontrolled Resource Consumption (CVE-2023-44487)

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

Rockwell Automation PowerMonitor 1000 Heap-Based Buffer Overflow (CVE-2024-12372)

A denial-of-service and possible remote code execution vulnerability exists in the affected product. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack. This plug...

Cisco NX-OS Fibre Channel over Ethernet Denial of Service (CVE-2017-6655)

A vulnerability in the Fibre Channel over Ethernet FCoE protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition when an FCoE-related process unexpectedly reloads. This vulnerability affects Cisco NX-OS Software o...

Korenix JetNet Use of Hard-coded Credentials (CVE-2020-12501)

Improper Authorization vulnerability of Korenix JetNet 5428G-20SFP, JetNet 5810G, JetNet 4706F, JetNet 4510, JetNet 5310, JetNet 4706, JetNet 5428G, JetNet 6095, JetNet 4706 use undocumented accounts. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...

Korenix JetNet Authenticated Command Injection (CVE-2020-12503)

Improper Authorization vulnerability of Korenix JetNet 5428G-20SFP, JetNet 5810G, JetNet 4706F, JetNet 4510, JetNet 5310, JetNet 4706, JetNet 5428G, JetNet 6095, JetNet 4706 are prone to multiple authenticated command injections. This plugin only works with Tenable.ot. Please visit...

GeoVision GV-VR360 and GV-VD8700 Path Traversal (CVE-2019-13408)

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication. This plugin only works with Tenable.ot. Please visit...

Siemens SCALANCE M-800 Use After Free (CVE-2024-4741)

Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Rockwell Automation Logix Controllers Uncontrolled Resource Consumption (CVE-2024-8626)

Due to a memory leak, a denial-of-service vulnerability exists in the affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain webpages of the product causing the affected products to become fully unavailable and require a power cycle to...