Marco Balduzzi

The issue is related to improper authentication, which may allow an attacker to deny service to the production line, steal sensitive data from the production line, and alter any products created by the production line.

The issue concerns the transmission of communication traffic involving the "Ethernet Q Commands" service in cleartext. This allows an attacker to obtain sensitive information being passed to and from the controller.

The issue is related to insufficient granularity of access control when using the "Ethernet Q Commands" service. This allows any user to write macros into registers outside of the authorized accessible range, potentially enabling access to privileged resources or resources out of context.

The issue concerns the "Ethernet Q Commands" service in the Haas Controller, where authentication is currently unsupported. This allows any user on the same network segment as the controller, including those connected remotely, to access the service and write unauthorized macros to the device.

Name of the Vulnerable Software and Affected Versions: Crimson 3.1 (Build versions prior to 3119.001) Description: An attacker could send a specially crafted message to the software that could leak arbitrary memory locations. Recommendations: For Crimson 3.1 (Build versions prior to 3119.001), update to a version 3119.001 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: JUUKO K-800 versions prior to numbers ending ...9A Description: The issue allows attackers to perform a replay attack and command forgery, potentially enabling them to replay commands, control the device, view commands, or cause the device to stop running. Recommendations: For JUUKO K-800 versions prior to numbers ending ...9A, update the firmware to a version with numbers ending ...9A or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: JUUKO K-808 versions prior to numbers ending ...9A, ...9B, ...9C, etc. Description: The issue allows remote attackers to execute commands on vulnerable installations of the equipment. No authentication is required to exploit this issue. The flaw lies in the handling of data between the transmitter and receiver. By using a fixed control code used for encoding data transmitted over radio frequency, an attacker can spoof unauthorized commands to the receiver. This can be used to send commands to physical equipment controlled by the device. Recommendations: For versions prior to numbers ending ...9A, ...9B, ...9C, etc., consider restricting access to the device until a patch is available. As a temporary workaround, avoid using the fixed control code for encoding data transmitted over radio frequency until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Moxa MGate 5105-MB-EIP version 4.1 Description: The issue is related to the DestIP parameter in the Moxa MGate 5105-MB-EIP firmware, which lacks proper validation of user-supplied strings before executing system calls. This allows remote attackers to execute arbitrary code, potentially leading to privilege escalation. The exploitation requires authentication. The vulnerability is exploited through the `DestIP` parameter within the `MainPing.asp` endpoint. Recommendations: For version 4.1, consider restricting access to the `MainPing.asp` endpoint and the `DestIP` parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows for unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state due to the use of fixed codes that can be reproducible by sniffing and re-transmission.

The issue allows an attacker to force-pair the device without human interaction, potentially leading to remote code execution.

The issue concerns the use of fixed codes in the Telecrane F25 Series Radio Controls, which can be reproduced by sniffing and re-transmission. This allows for unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state.

The issue allows an attacker with physical access to the product to potentially reprogram it.

The issue allows for a replay attack and command forgery.