Haas Controller
Successful exploitation of these vulnerabilities could allow an unauthorized attacker to cause denial-of-service of the production line, damage the tools used in the production line, introduce defects in pieces of the production line, and perform remote code execution.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-41636US | high7.5OT elevated | — | ||
Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This allows an attacker to obtain sensitive in… | ||||
| CVE-2022-2475US | high8.8 | — | ||
Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers… | ||||
| CVE-2022-2474US | high8.0OT elevated | — | ||
Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the same network segment a… | ||||
references
External citations — patches, advisories, analysis.
remediations (3)
- MitigationHaas Controller
Add authentication to the “Ethernet Q Commands” service and use a strong enforced password.
- MitigationHaas Controller
Add authentication to the “Ethernet Q Commands” service and use a strong enforced password.
- MitigationHaas Controller
Add authentication to the “Ethernet Q Commands” service and use a strong enforced password.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan