Aleksandr Timorin

The issue is caused by multiple stack-based buffer overflows in the IniNet embeddedWebServer. Exploitation of these issues may allow a remote attacker to execute arbitrary code via a long field in an HTTP request.

The issue allows context-dependent attackers to obtain sensitive information due to the use of cleartext for password storage.

The issue arises from the mishandling of URL encoding, allowing remote attackers to write to or delete files by using a crafted string.

The issue allows remote attackers to establish arbitrary authorization data by modifying project files that lack integrity protection, which determines a user's privileges.

The issue allows local users to determine cleartext passwords by reading a project file and conducting a brute-force attack due to the use of a weak password-hash algorithm.

The issue allows remote attackers to cause a denial of service, resulting in the device transitioning to defect mode, which lasts until a hardware reset is performed. This is achieved by sending specially crafted PROFINET packets.

The issue concerns the random-number generator, which lacks sufficient entropy. This weakness can be exploited by remote attackers to bypass cryptographic protection mechanisms and hijack sessions.

A cross-site request forgery (CSRF) issue affects the software, allowing remote attackers to hijack the authentication of victims via unknown vectors. The vulnerability is also described as affecting the embedded server of the Simatic S7-1200 programmable logic controller, specifically on port 80 TCP and port 443 TCP, enabling cross-site request forgery.

The issue allows remote attackers to cause a denial of service, resulting in a defect-mode transition, by sending crafted Profinet packets.