ads-tec Industrial IT: Multiple Vulnerabilities in ADS-TEC IRF Products
The ADS-TEC IRF1000 and IRF3000 products are affected by multiple vulnerabilities in firmware releases prior to 2.3.0: authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware 2.3.0.
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-14171US | — | — | ||
An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of c… | ||||
| CVE-2026-14169US | — | — | ||
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could resul… | ||||
| CVE-2026-14168US | —OT erhöht | — | ||
A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system acces… | ||||
| CVE-2026-14167US | —OT erhöht | — | ||
A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization. | ||||
| CVE-2026-40510US | medium6.8 | — | ||
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically presen… | ||||
| CVE-2026-5172US | — | Exploit | ||
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extra… | ||||
| CVE-2026-4893US | — | Exploit | ||
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information. | ||||
| CVE-2026-2291US | — | Exploit | ||
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirec… | ||||
| CVE-2026-22796US | — | — | ||
Issue summary: A type confusion vulnerability exists in the signature
verification of signed PKCS#7 data where an ASN1_TYPE union member is
accessed without first validating the ty… | ||||
| CVE-2026-22795US | — | — | ||
Issue summary: An invalid or NULL pointer dereference can happen in
an application processing a malformed PKCS#12 file.
Impact summary: An application processing a malformed PKCS#… | ||||
| CVE-2025-69421US | high7.5 | Exploit | ||
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer
dereference in the PKCS12_item_decrypt_d2i_ex() function.
Impact summary: A NULL pointer dereference… | ||||
| CVE-2025-69420US | — | Exploit | ||
Issue summary: A type confusion vulnerability exists in the TimeStamp Response
verification code where an ASN1_TYPE union member is accessed without first
validating the type, caus… | ||||
| CVE-2025-69419US | — | Exploit | ||
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
non-ASCII BMP code point can tr… | ||||
| CVE-2025-69418US | — | — | ||
Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the… | ||||
| CVE-2025-68160US | — | — | ||
Issue summary: Writing large, newline-free data into a BIO chain using the
line-buffering filter where the next BIO performs short writes can trigger
a heap-based out-of-bounds wri… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (30)
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires physical access. Restrict physical access to the device and to its USB and smart-card interfaces, and do not connect untrusted PIV smart cards or CCID/USB devices.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
- Mitigation
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
- Mitigation
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
- Behoben
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan