Search vulnerabilities

Expected end of text, found 'èmes' (at char 20), (line:1, col:21)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,822

CVE-2020-12510

Beckhoff: Privilege Escalation through TwinCat System

The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for automatic execution upon log in of a user. If a less privileged user has a local account he or she can replace TcSysUI.exe. It will be executed automatically by another user during login. This is also true for users with administrative access. Consequently, a less privileged user can trick a higher privileged user into executing code he or she modified this way. By default Beckhoff’s IPCs are shipped with TwinCAT software installed this way and with just a single local user configured. Thus the vulnerability exists if further less privileged users have been added.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Twincat Extended Automation Runtime
CVE-2020-12506

WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO 750-862, WAGO 750-891, WAGO 750-890/xxx-xxx in versions FW03 and prior versions.

CVSS 3.1 · 9.1 Critical EPSS 1.5% KEV · Not listed
Vendors
Wago
Products
750-362 750-362 Firmware 750-363 and 11 more
CVE-2020-12505

WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852, WAGO 750-880/xxx-xxx, WAGO 750-881, WAGO 750-831/xxx-xxx, WAGO 750-882, WAGO 750-885/xxx-xxx, WAGO 750-889 in versions FW07 and below.

CVSS 3.1 · 8.2 High EPSS 1.2% KEV · Not listed
Vendors
Wago
Products
750-831 750-831 Firmware 750-852 and 11 more
CVE-2020-12504

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Korenix Pepperl-fuchs Westermo
Products
Jetwave 2212g Jetwave 2212g Firmware Jetwave 2212s and 55 more
CVE-2020-12503

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.

CVSS 3.1 · 7.2 High EPSS 22.8% KEV · Not listed
Vendors
Korenix Pepperl-fuchs
Products
Jetnet 4510 Jetnet 4510 Firmware Jetnet 4706 and 53 more
CVE-2020-12502

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Korenix Pepperl-fuchs
Products
Jetnet 4510 Jetnet 4510 Firmware Jetnet 4706 and 43 more
CVE-2020-12501

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Korenix Pepperl-fuchs
Products
Jetnet4510 Firmware Jetnet4706 Firmware Jetnet4706f Firmware and 49 more
CVE-2020-12500

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Pepperl-fuchs
Products
Es7506 Es7506 Firmware Es7510 and 23 more
CVE-2020-12499

PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.

In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Plcnext Engineer
CVE-2020-12498

Phoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code execution

mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Phoenixcontact
Products
Pc Worx Pc Worx Express
CVE-2020-12497

Phoenix Contact Automation Worx <= 1.87: stack-based overflow

PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

CVSS 3.1 · 7.8 High EPSS 14.7% KEV · Not listed
Vendors
Phoenixcontact
Products
Pc Worx Pc Worx Express
CVE-2020-12496

ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actor

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to the server, which makes repeating requests and analysis complex enough. Nevertheless, it's possible and during the analysis it was discovered that it also has an issue with the access-control matrix on the server-side. It was found that a user with low rights can get information from endpoints that should not be available to this user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Endress
Products
Orsg35 Orsg35 Firmware Orsg45 and 5 more
CVE-2020-12495

ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens". The vulnerability is that user sessions are not closed correctly and a user with fewer rights is assigned the higher rights when he logs on.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Endress
Products
Orsg35 Orsg35 Firmware Orsg45 and 5 more
CVE-2020-12494

Beckhoff: Etherleak in TwinCAT RT network driver

Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Beckhoff Intel
Products
Twincat Twincat Driver 82540em and 17 more
CVE-2020-12493

Critical Vulnerability in SWARCO CPU LS4000

An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices.

CVSS 3.1 · 10 Critical EPSS 1.4% KEV · Not listed
Vendors
Swarco
Products
Cpu Ls4000 Firmware
CVE-2020-12488

Broken Access Control Vulnerability in Jovi Smart Scene

The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vivo
Products
Jovi Smart Scene