ifm: Vulnerabilities in ifm AC14 firmware
In ifm Smart PLC firmware up to version 4.3.17 for Smart PLC controllers AC14xx and AC4xxS, an attacker can access the configuration by using the hardcoded credentials. The endpoint hosts a scripts capable of executing various commands.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-28751US | —OT elevated | — | ||
An high privileged remote attacker can enable telnet access that accepts hardcoded credentials. | ||||
| CVE-2024-28750US | — | — | ||
A remote attacker with high privileges may use a deleting file function to inject OS commands.
| ||||
| CVE-2024-28749US | — | — | ||
A remote attacker with high privileges may use a writing file function to inject OS commands.
| ||||
| CVE-2024-28748US | — | — | ||
A remote attacker with high privileges may use a reading file function to inject OS commands.
| ||||
| CVE-2024-28747US | —OT elevated | — | ||
An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.
| ||||
references
External citations — patches, advisories, analysis.
remediations (10)
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Fixed
Update to Firmware Version 6.1.8 or later.
- Fixed
Update to Firmware Version 6.1.8 or later.
- Fixed
Update to Firmware Version 6.1.8 or later.
- Fixed
Update to Firmware Version 6.1.8 or later.
- Fixed
Update to Firmware Version 6.1.8 or later.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan