Federico Maggi

The issue allows an attacker to send a specially crafted packet to flood a target device with unwanted traffic. This may result in a denial-of-service condition and information exposure.

The issue arises when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, potentially resulting in a denial-of-service condition.

The issue arises from inconsistent handling of a length parameter in relation to the actual length of associated data. This inconsistency may allow an attacker to remotely execute arbitrary code.

The issue is related to a write-what-where condition that may allow an attacker to write arbitrary values in the XML parser. This could potentially be exploited by an attacker.

The issue arises when an attacker sends a specially crafted packet to flood target devices with unwanted traffic. This may result in a denial-of-service condition and information exposure.

The issue concerns the transmission of simulation models in plaintext from a KUKA-maintained server to devices requesting these models.

Name of the Vulnerable Software and Affected Versions: JUUKO K-808 versions prior to numbers ending ...9A, ...9B, ...9C, etc. Description: The issue allows remote attackers to execute commands on vulnerable installations of the equipment. No authentication is required to exploit this issue. The flaw lies in the handling of data between the transmitter and receiver. By using a fixed control code used for encoding data transmitted over radio frequency, an attacker can spoof unauthorized commands to the receiver. This can be used to send commands to physical equipment controlled by the device. Recommendations: For versions prior to numbers ending ...9A, ...9B, ...9C, etc., consider restricting access to the device until a patch is available. As a temporary workaround, avoid using the fixed control code for encoding data transmitted over radio frequency until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: JUUKO K-800 versions prior to numbers ending ...9A Description: The issue allows attackers to perform a replay attack and command forgery, potentially enabling them to replay commands, control the device, view commands, or cause the device to stop running. Recommendations: For JUUKO K-800 versions prior to numbers ending ...9A, update the firmware to a version with numbers ending ...9A or later to resolve the issue.

The issue allows for unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state due to the use of fixed codes that can be reproducible by sniffing and re-transmission.

This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is not required to exploit this issue. The specific flaw exists within the parsing of MQTT PUBLISH packets, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of the current process.

The issue concerns the use of fixed codes in the Telecrane F25 Series Radio Controls, which can be reproduced by sniffing and re-transmission. This allows for unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state.

The issue allows an attacker with physical access to the product to potentially reprogram it.

The issue allows an attacker to force-pair the device without human interaction, potentially leading to remote code execution.

The issue allows for a replay attack and command forgery.

The issue concerns the use of hard-coded credentials in the software, which could allow an attacker to reset passwords for the controller.

This issue allows remote attackers to deny service on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash, allowing an attacker to deny access to the target system.

The issue allows remote attackers to obtain sensitive information, including intranet IP addresses and enumerations of valid parameter values, by making a direct request to `hc`. This sensitive information is revealed in an error message or a cookie.