Helmholz PSIRT (CSAF)
advisoryDEhelmholz_psirt
Helmholz PSIRT CSAF 2.0 advisories (hosted by CERT@VDE).
01
advisories (23)
Vendor and ecosystem advisories describing this.
02
product assertions (99)
Products and version ranges known to be affected.
- Firmware 1.10.210 installed on WALl IE Standard 4-Port
- Firmware 1.12.015 installed on FLEXtra FLAT PROFINET-Switch 16-Port
- Firmware 1.12.015 installed on FLEXtra FLAT PROFINET-Switch 4-Port
- Firmware 1.12.015 installed on FLEXtra FLAT PROFINET-Switch 8-Port
- Firmware 1.12.100 installed on FLEXtra FLAT PROFINET-Switch 16-Port
- Firmware 1.12.100 installed on FLEXtra FLAT PROFINET-Switch 4-Port
- Firmware 1.12.100 installed on FLEXtra FLAT PROFINET-Switch 8-Port
- Firmware 1.12.232 installed on WALl IE Standard 4-Port
- Firmware 2.10.1 installed on myREX24
- Firmware 2.10.1 installed on myREX24-virtual
- Firmware 2.12.1 installed on myREX24
- Firmware 2.12.1 installed on myREX24.virtual
- Firmware 2.16.1 installed on myREX24 V2
- Firmware 2.16.1 installed on myREX24 V2 virtual
- Firmware 2.16.2 installed on Helmholz myREX24V2
- Firmware 2.16.2 installed on myREX24 V2
- Firmware 2.16.2 installed on myREX24.virtual
- Firmware 2.16.3 installed on Helmholz myREX24V2
- Firmware 2.16.5 installed on myREX24
- Firmware 2.16.5 installed on myREX24.virtual
showing 20 of 99
03
CVE links (103)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-14448US | — | — | ||
An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special element… | ||||
| CVE-2026-10521US | — | — | ||
An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a… | ||||
| CVE-2026-40852US | — | — | ||
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value… | ||||
| CVE-2026-40851US | — | — | ||
A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confiden… | ||||
| CVE-2026-40850US | — | — | ||
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a… | ||||
| CVE-2026-40849US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a S… | ||||
| CVE-2026-40848US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT comm… | ||||
| CVE-2026-40847US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELE… | ||||
| CVE-2026-40846US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT c… | ||||
| CVE-2026-40845US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in… | ||||
| CVE-2026-40844US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELEC… | ||||
| CVE-2026-40843US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT… | ||||
| CVE-2026-40842US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a S… | ||||
| CVE-2026-40841US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a… | ||||
| CVE-2026-40840US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements… | ||||
| CVE-2026-40839US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements… | ||||
| CVE-2026-40838US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in… | ||||
| CVE-2026-40837US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements i… | ||||
| CVE-2026-40836US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELE… | ||||
| CVE-2026-40835US | — | — | ||
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements i… | ||||
showing 20 of 103