ifm: Vulnerabilities in ifm AC14 firmware
In ifm Smart PLC firmware up to version 4.3.17 for Smart PLC controllers AC14xx and AC4xxS, an attacker can access the configuration by using the hardcoded credentials. The endpoint hosts a scripts capable of executing various commands.
beschreibt (5)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-28751US | —OT erhöht | — | ||
An high privileged remote attacker can enable telnet access that accepts hardcoded credentials. | ||||
| CVE-2024-28750US | — | — | ||
A remote attacker with high privileges may use a deleting file function to inject OS commands.
| ||||
| CVE-2024-28749US | — | — | ||
A remote attacker with high privileges may use a writing file function to inject OS commands.
| ||||
| CVE-2024-28748US | — | — | ||
A remote attacker with high privileges may use a reading file function to inject OS commands.
| ||||
| CVE-2024-28747US | —OT erhöht | — | ||
An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.
| ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (10)
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Mitigation
When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.
- Behoben
Update to Firmware Version 6.1.8 or later.
- Behoben
Update to Firmware Version 6.1.8 or later.
- Behoben
Update to Firmware Version 6.1.8 or later.
- Behoben
Update to Firmware Version 6.1.8 or later.
- Behoben
Update to Firmware Version 6.1.8 or later.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan