CVE-2022-21176

Airspan Networks Mimosa SQL Injection

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information.

CVSS 3.1 · 8.6 High EPSS 1.1% KEV · Not listed

Vendors

Airspan

Products

A5x A5x Firmware C5c and 6 more

CVE-2022-21141

Airspan Networks Mimosa Incorrect Authorization

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

CVSS 3.1 · 10 Critical EPSS 3.2% KEV · Not listed

Vendors

Airspan

Products

A5x A5x Firmware C5c and 6 more

CVE-2022-23922

WIN-911 2021 Incorrect Default Permissions

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the Program Announcer directory and elevate permissions whenever the program is executed.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Win-911

Products

Win-911 2021 R1 Win-911 2021 R2

CVE-2022-23104

WIN-911 2021 Incorrect Default Permissions

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace directory, which holds DLL files and executables. A low-privilege attacker could write a malicious DLL file to the Operator Workspace directory to achieve privilege escalation and the permissions of the user running the program.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Win-911

Products

Win-911 2021 R1 Win-911 2021 R2

CVE-2020-10635

ICSA-20-098-05 KUKA.Sim Pro Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a model, the server transmits the model in plaintext.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kuka

Products

Sim Pro

CVE-2020-10640

ICSA-20-140-02 Emerson OpenEnterprise

Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service.

CVSS 3.1 · 10 Critical EPSS 3.1% KEV · Not listed

Vendors

Emerson

Products

Openenterprise Scada Server

CVE-2020-10636

ICSA-20-140-02 Emerson OpenEnterprise

Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Emerson

Products

Openenterprise Scada Server

CVE-2022-25922

ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497

Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Hegemonelectronics

Products

Plc4trucks Plc4trucks Firmware

CVE-2022-26131

ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497

Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals.

CVSS 3.1 · 9.3 Critical EPSS 1.3% KEV · Not listed

Vendors

Hegemonelectronics

Products

Plc4trucks Plc4trucks Firmware

CVE-2022-21146

ICSA-22-062-01 IPCOMM ipDIO

Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into a specific parameter. The XSS payload will be executed when a legitimate user attempts to review history.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ipcomm

Products

Ipdio Ipdio Firmware

CVE-2022-24432

ICSA-22-062-01 IPCOMM ipDIO

Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ipcomm

Products

Ipdio Ipdio Firmware

CVE-2021-27416

Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hitachienergy

Products

Ellipse Enterprise Asset Management

CVE-2021-27414

User interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAM

An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentials.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hitachienergy

Products

Ellipse Enterprise Asset Management

CVE-2022-25247

PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed

Vendors

Ptc

Products

Axeda Agent Axeda Desktop Server

CVE-2022-25246

PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials

Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of the host operating system.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Ptc

Products

Axeda Agent Axeda Desktop Server

CVE-2022-25248

PTC Axeda agent and Axeda Desktop Server Information Exposure

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ptc

Products

Axeda Agent Axeda Desktop Server

CVE-2022-25249

PTC Axeda agent and Axeda Desktop Server Path Traversal

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain file system read access via web server..

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Ptc

Products

Axeda Agent Axeda Desktop Server

CVE-2022-25250

PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to shut down a specific service.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Ptc

Products

Axeda Agent Axeda Desktop Server

CVE-2022-25252

PTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional Conditions

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Ptc

Products

Axeda Agent Axeda Desktop Server

CVE-2022-25251

PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to read and modify the affected product’s configuration.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Ptc

Products

Axeda Agent Axeda Desktop Server