CVE-2020-16232

Yokogawa WideField3 Buffer Copy Without Checking Size of Input

In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file.

CVSS 3.1 · 2.8 Low EPSS < 1% KEV · Not listed

Vendors

Yokogawa

Products

Widefield3

CVE-2020-25180

Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Rockwellautomation Schneider-electric Xylem

Products

Aadvance Controller Isagraf Free Runtime Isagraf Runtime and 28 more

CVE-2020-25197

GE Reason RT43X Clocks Code Injection

A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Ge

Products

Rt430 Rt430 Firmware Rt431 and 3 more

CVE-2020-25193

GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key

By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ge

Products

Rt430 Rt430 Firmware Rt431 and 3 more

CVE-2021-27456

Philips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access Control

Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Phillips

Products

Gemini 882160 Gemini 882160 Firmware Gemini 882300 and 19 more

CVE-2021-27418

GE UR family input validation

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ge

Products

Multilin B30 Multilin B30 Firmware Multilin B90 and 35 more

CVE-2021-27420

GE UR family input validation

GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself, this is not particularly significant as the relay remains effective in all other functionality and communication channels.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Ge

Products

Multilin B30 Multilin B30 Firmware Multilin B90 and 35 more

CVE-2021-27424

GE UR family exposure of sensitive information to an unauthorized actor

GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ge

Products

Multilin B30 Multilin B30 Firmware Multilin B90 and 35 more

CVE-2021-27428

GE UR family Unrestricted Upload of File with Dangerous Type

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Ge

Products

Multilin B30 Multilin B30 Firmware Multilin B90 and 35 more

CVE-2021-27426

GE UR family insecure default variable initialization

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Ge

Products

Multilin B30 Multilin B30 Firmware Multilin B90 and 35 more

CVE-2021-27422

GE UR family exposure of sensitive information to an unauthorized actor

GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ge

Products

Multilin B30 Multilin B30 Firmware Multilin B90 and 35 more

CVE-2021-27460

Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain full access to the FactoryTalk AssetCentre main server and all agent machines.

CVSS 3.1 · 10 Critical EPSS 3.2% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27462

Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CVSS 3.1 · 10 Critical EPSS 3.8% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27464

Rockwell Automation FactoryTalk AssetCentre SQL Injection

The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

CVSS 3.1 · 10 Critical EPSS 3.5% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27472

Rockwell Automation FactoryTalk AssetCentre SQL Injection

A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.

CVSS 3.1 · 10 Critical EPSS 5.7% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27468

Rockwell Automation FactoryTalk AssetCentre SQL Injection

The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

CVSS 3.1 · 10 Critical EPSS 3.5% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27474

Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre.

CVSS 3.1 · 10 Critical EPSS 1.6% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27466

Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CVSS 3.1 · 10 Critical EPSS 3.9% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27470

Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CVSS 3.1 · 10 Critical EPSS 3.8% KEV · Not listed

Vendors

Rockwellautomation

Products

Factorytalk Assetcentre

CVE-2021-27473

Rockwell Automation Connected Components Workbench Improper Input Validation

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive file that, when opened by Connected Components Workbench, will allow the attacker to gain the privileges of the software. If the software is running at SYSTEM level, the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Connected Components Workbench