Michael Flanders

This issue allows network-adjacent attackers to bypass authentication on affected installations. The flaw exists within the processing of path strings, specifically by inserting a null byte into the path, which enables the user to skip most authentication checks. An attacker can leverage this to bypass authentication on the system.

The issue arises because the device does not check the length or size of a project file before copying its entire contents to a heap-based buffer.

The program does not properly parse FNC files, which may allow for information disclosure.

The issue arises from the program's failure to properly check user-supplied comments, potentially allowing for arbitrary remote code execution.

A vulnerability in the lack of validation of user-supplied parameters passed to XML-RPC calls allows remote users to execute arbitrary code.

The issue is related to improper input validation, which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used. This can lead to remote code execution vulnerabilities. Various components and modules within the ABB Panel Builder 800 are affected, including those related to ModBus, TCP/IP addresses, and user settings. The vulnerability can be exploited through stack-based or heap-based buffer overflows, as well as format string vulnerabilities.