ifm PSIRT (CSAF)

An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, poten…

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to…

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication.

An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.

A remote attacker with high privileges may use a deleting file function to inject OS commands.

A remote attacker with high privileges may use a writing file function to inject OS commands.

A remote attacker with high privileges may use a reading file function to inject OS commands.

An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.

An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.

In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full contr…