CVE-2022-32514: Improper Authentication

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC Versions prior to V1.10.0, Wiser for C-Bus Automation Controller - LSS5500SHAC...

CVE-2022-32514

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC Versions prior to V1.10.0, Wiser for C-Bus Automation Controller - LSS5500SHAC...

CVE-2022-32513: Weak Password Requirements

A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC Versions prior to V1.10.0, Wiser for C-Bus Automation Controller -...

Schneider Electric C-Bus多款产品 授权问题漏洞

Schneider Electric C-Bus Home Automation is a series of bus-based home automation systems from French company Schneider Electric. An authorization issue vulnerability exists in various Schneider Electric C-Bus products, which stems from an improper authentication mechanism that allows an attacker...

Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root

SpaceLogic.ps1 Schneider Electric SpaceLogic C-Bus Home Controller 5200WHC2 Remote Root Exploit Vendor: Schneider Electric SE Product web page: https://www.se.com https://www.se.com/ww/en/product/5200WHC2/home-controller-spacelogic-cbus-cbus-ip-free-standing-24v-dc/...

CVE-2022-34753

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller 5200WHC2, formerly known as C-Bus Wiser Homer Controlle...

Wiser Smart PLC Authentication Bypass

The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, relates to authentication process errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected informatio...

Wiser Smart PLC RCE

The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, lies in the use of strictly encrypted user credentials. Exploiting this vulnerability could allow an attacker to execute arbitrary codes remotely...

Schneider Electric Automation Controllers Auth Bypass

The vulnerabilities of Schneider Electric’s automation controllers—C-Bus LSS5500NAC, Wiser for C-Bus LSS5500SHAC, Clipsal C-Bus 5500NAC, Clipsal Wiser for C-Bus 5500SHAC, and SpaceLogic C-Bus 5500NAC2, 5500AC2—are related to authentication process errors. Exploiting these vulnerabilities can allo...

Schneider Electric Automation Controllers Weak Password Requirements

The vulnerabilities of Schneider Electric’s automation controllers with microprogrammed software, such as C-Bus LSS5500NAC, Wiser for C-Bus LSS5500SHAC, Clipsal C-Bus 5500NAC, Clipsal Wiser for C-Bus 5500SHAC, and SpaceLogic C-Bus 5500NAC2, 5500AC2, are related to weak password requirements...

Wiser Smart PLC Resource Allocation Unauthorized Access

The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, relates to improper movement of resources between different areas. Exploiting this vulnerability can allow an attacker operating remotely to gain...

Wiser Smart PLC Privilege Escalation

The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, relates to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to enhance their privileges through a...

Wiser Smart PLC Authentication Bypass

The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to gain unauthorized...

Schneider Electric Automation Controllers Command Injection

The vulnerability of Schneider Electric’s automation controllers C-Bus 5500SHAC and Wiser for C-Bus 5500SHAC lies in the possibility of command injection. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on behalf of the superuser...

Wiser Smart PLC Data Encryption

The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, lies in the lack of data encryption measures. Exploiting this vulnerability could allow a malicious actor to retrieve authentication credentials fo...

CVE-2022-30233

A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked into performing certain actions on a webpage. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-30235

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute force. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-30237

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attacker breaks the encoding. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-30234

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtained. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-30236

A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...