DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
ABB AC-500: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-04-02
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ABB AC-500 ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Dateien zu manipulieren.
01
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-3192US | medium5.3 | — | ||
Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6.
| ||||
| CVE-2022-32143US | medium6.5 | — | ||
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed… | ||||
| CVE-2022-32142US | medium5.5 | — | ||
Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bou… | ||||
| CVE-2022-32141US | medium4.0 | — | ||
Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read… | ||||
| CVE-2022-32140US | medium4.0 | — | ||
Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the ser… | ||||
| CVE-2022-32139US | medium4.0 | — | ||
In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction… | ||||
| CVE-2022-32138US | medium6.5 | — | ||
In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite. | ||||
| CVE-2022-32137US | medium6.5 | — | ||
In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memo… | ||||
| CVE-2022-32136US | medium6.5 | — | ||
In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User inte… | ||||
| CVE-2022-31805US | medium4.3 | — | ||
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. | ||||
| CVE-2022-1965US | medium5.5 | — | ||
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In con… | ||||
| CVE-2021-34595US | high8.1 | — | ||
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan