Eyal Udassin

The issue allows remote authenticated users to gain privileges via unknown vectors.

The issue is related to a buffer overflow in the MLF application, which can be exploited by remote attackers to execute arbitrary commands or cause a denial of service, resulting in a system crash. The exact vectors used for the exploitation are not specified.

The issue allows remote attackers to cause a denial of service, resulting in a system crash, via unknown vectors.

The issue allows remote attackers to cause a denial of service, resulting in a system crash, via unknown vectors.

The issue allows remote attackers to cause a denial of service, resulting in a system crash, via unknown vectors.

Name of the Vulnerable Software and Affected Versions: ABB Process Communication Unit 400 (PCU400) versions 4.4 through 4.6 Description: The issue allows remote attackers to execute arbitrary code via a crafted packet using the (1) IEC60870-5-101 or (2) IEC60870-5-104 communication protocol to the X87 web interface. This is due to a buffer overflow in x87 before version 3.5.5. Recommendations: For versions 4.4 through 4.6, update to version 3.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the X87 web interface to minimize the risk of exploitation.

The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory. This is due to an unrestricted file upload vulnerability.

The issue is related to a heap-based buffer overflow in the w32rtr.exe component. This allows remote attackers to execute arbitrary code via unknown vectors.

The issue allows remote attackers to steal passwords and gain privileges due to the use of HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext.