CVE-2015-3971

CVE-2015-3971 for Janitza UMG devices (508, 509, 511, 604, 605) : The debug/web interface on these UMG devices exposes an unauthenticated session over TCP port 1239, allowing remote attackers to read/write files or execute arbitrary JASIC code. This constitutes unauthenticated remote control of t...

CVE-2015-3968

Summary of CVE-2015-3968 : The Janitza UMG power quality devices (models 508, 509, 511, 604, 605) expose an FTP interface protected by a default/password-hardcoded credential, enabling remote attackers to read or write files via TCP port 21. The root cause is weak/default credentials in the devic...

CVE-2015-3972

The CVE refers to Janitza UMG power quality devices (UMG 508, 509, 511, 604, and 605). The underlying issue is weak authentication via the web interface, caused by allowing only short PIN values and insufficient randomization of session tokens, enabling remote brute-force access. Impact per sourc...

CVE-2015-3970

The CVE-2015-3970 entry concerns Janitza UMG power quality devices (UMG 508, 509, 511, 604, 605). It describes multiple cross-site scripting (XSS) vulnerabilities in the device web interface that allow remote attackers to inject arbitrary script/HTML via unspecified vectors. The issue is accessib...

CVE-2015-3969

CVE-2015-3969 affects Janitza UMG power quality devices (UMG 508/509/511/604/605). The vulnerability is an information-disclosure issue where remote attackers can obtain sensitive network-connection information by sending requests to UDP ports 1234 or 1235. Public exploits exist for this CVE; the...

CVE-2015-3967

CVE-2015-3967 affects Janitza UMG power quality devices (UMG 508, 509, 511, 604, 605). It is a Cross-Site Request Forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of arbitrary users. Exploitation is described as possible remotely, and public exploits exist fo...

CVE-2015-3973

CVE-2015-3973 affects Janitza UMG power quality devices (UMG 508, 509, 511, 604, 605). The root cause is improper session token generation, where session tokens derive from the 4‑digit PIN plus a server‑generated challenge, enabling an attacker to potentially determine the PIN from session tokens...