Vladimir Dashchenko

The issue is related to insufficient input validation, allowing an attacker with access to the project file to execute arbitrary system commands with the privileges of the local database server. This could impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication, no public exploitation of this security issue was known.

An attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server, causing the ClearSCADA server process and ClearSCADA communications driver processes to terminate.

The issue concerns an unencrypted method of remote control and communications in the affected devices.

The issue concerns an unsecured way of firmware update in Hanwha Techwin Smartcams.

The issue concerns an undocumented capability for switching the web interface in Hanwha Techwin Smartcams.

A buffer overflow issue has been identified.

The issue concerns an authentication bypass in Hanwha Techwin Smartcams. No further details are provided about the nature of the bypass or its potential impact.

The issue concerns a remote password change in Hanwha Techwin Smartcams.

The issue allows for arbitrary camera access and monitoring via the cloud.

The issue allows for a denial of service by blocking new camera registration on the cloud server.

The issue allows for denial of service by uploading malformed firmware.

The issue is related to remote code execution in Hanwha Techwin Smartcams. A software vulnerability exists in Hanwha Techwin SNH-V6410PN and SNH-V6410PNW cameras due to insufficient input validation. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code.

An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules where weakly encrypted passwords are transmitted to a MELSEC-Q PLC.

The issue is related to a factory account with hard-coded passwords in SICAM PAS installations. This could allow attackers to gain privileged access to the database over Port 2638/TCP. The vulnerability might be exploited by a remote attacker to obtain privileged access to the database.

The issue allows remote attackers to perform unauthorized file system modifications, including writing to files, renaming files, creating directories, or deleting directories, by sending crafted packets.

The issue allows remote attackers to execute arbitrary SQL commands via crafted traffic to the TCP port 4410. This can be achieved by sending malicious input to the affected system, potentially leading to unauthorized data access or modification.

The issue allows remote attackers to cause a denial of service, resulting in an ALM service outage, by sending crafted packets to TCP port 4410.

The issue allows remote attackers to cause a denial of service, specifically an OPC UA service outage, by sending crafted TCP packets.

The issue is related to errors in the password encryption algorithm of the RSView32 SCADA system, which can be exploited by a local attacker to gain access to the system and make unauthorized changes to the controlled process, potentially leading to its shutdown or creation of an emergency situation. Local users can obtain sensitive information by reading a file and conducting a decryption attack due to improper encryption of credentials.