Maxim Rupp

The issue is due to the lack of adequately implemented access-control rules, allowing an attacker to view and modify application settings without authenticating by accessing a specific uniform resource locator (URL) on the webserver. This can be done by accessing certain URLs, which can be set through the web interface or using brute force. The attacker can change various settings, including those related to sensors, tank information, and alarm threshold values, potentially leading to an emergency situation. The vulnerable product is used worldwide in the water supply and drainage sector.

The issue allows an attacker with network access to the device's web interface to circumvent the authentication scheme by using a specific credential string, potentially performing administrative operations.

The affected application does not properly restrict access to an endpoint responsible for saving settings, allowing an unauthenticated user with limited access rights to change application settings without authenticating. This is due to the lack of adequately implemented access-control rules, which can be exploited by accessing a specific uniform resource locator (URL) on the web server, violating the originally laid ACL rules.

Name of the Vulnerable Software and Affected Versions: WAGO PLCs versions up to FW07 Description: This issue allows an attacker with access to the WBM to read and write device settings-parameters by sending specifically constructed requests without authentication. Recommendations: For versions up to FW07, consider restricting access to the WBM to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows the password to be changed without requiring the current password, potentially enabling unauthorized changes by users or external processes. This is due to the lack of a requirement to enter the current password when changing it on the module webpage.

The issue concerns exposure of sensitive information to unauthorized actors. The firmware release utilizes a dynamic token for each request submitted to the server, complicating repeating requests and analysis. However, it was discovered that there is an issue with the access-control matrix on the server-side, allowing a user with low rights to access information from endpoints that should not be available to them.

The affected device has a web-based user interface with a role-based access system, where users with different roles have different write and read privileges. The access system is based on dynamic "tokens". The issue arises because user sessions are not closed correctly, allowing a user with fewer rights to be assigned higher rights when they log on.

The issue concerns inadequate user authorization validation in certain routes of the system, allowing unauthorized access to configuration data. A user with knowledge of the system's routes can read and write configuration data without proper authorization.

The issue is related to an Improper Authentication vulnerability in the WAGO 750-8XX series, which allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication. This can be done remotely.

The issue is related to improper authentication in the WAGO ethernet controller, allowing a remote attacker to change some special parameters without authentication. This can be exploited by an attacker to modify certain settings.

The issue concerns the Password Change Function, which does not require knowledge of the old password. This can be exploited, potentially allowing unauthorized access.

The issue allows a malicious website visited by an authenticated admin user or a malicious mail to make arbitrary changes in the "admin panel" because there is no CSRF protection.

Name of the Vulnerable Software and Affected Versions: OZW672 versions prior to V10.00 OZW772 versions prior to V10.00 Description: A security issue has been identified where vulnerable versions of OZW Web Server use predictable path names for project files created by authenticated users through the export function. This allows a remote attacker to download project files without authentication by accessing a specific uniform resource locator on the web server. The issue can be exploited by an unauthenticated attacker with network access, without requiring any user interaction. Successful exploitation compromises the confidentiality of the targeted system. Recommendations: For OZW672 versions prior to V10.00, update to version V10.00 or later to resolve the issue. For OZW772 versions prior to V10.00, update to version V10.00 or later to resolve the issue.

An issue exists where an attacker can edit settings on the device using a specially crafted URL.

An issue was discovered that allows command injection to occur in the WebHMI component.

The issue allows an attacker to upload a malicious language file by bypassing the user authentication mechanism.

The issue allows an attacker to bypass the user authentication mechanism, enabling them to read sensitive configuration files.

Name of the Vulnerable Software and Affected Versions: Ice Qube Thermal Management Center versions prior to 4.13 Description: The issue concerns the storage of passwords in plaintext within a file that can be accessed without authentication, posing a significant security risk. Recommendations: For versions prior to 4.13, update to version 4.13 or later to resolve the issue of plaintext password storage.

The issue allows an attacker with network access to the integrated web server to retrieve default or user-defined credentials. These credentials are stored and transmitted in an insecure manner.

A security issue was found in the ProMinent MultiFLEX M10a Controller web interface, where it is possible to change a user's password without knowing the original password. This could allow an authenticated attacker to change a user's password, enabling future access and possible configuration changes.