Aleksey Osipov

**Name of the Vulnerable Software and Affected Versions** Advantech WebAccess versions prior to 8.1 **Description** The issue is related to an unrestricted file upload vulnerability. This vulnerability can be exploited by a remote attacker to modify files of any type. The vulnerability is associated with the `uploadImageCommon` function in the UploadAjaxAction script in the WebAccess Dashboard Viewer. **Recommendations** For versions prior to 8.1, update to version 8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `uploadImageCommon` function in the UploadAjaxAction script until a patch is available. Restrict access to the UploadAjaxAction script to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Rockwell Automation Allen-Bradley MicroLogix 1100 controller versions prior to 14.000 Rockwell Automation Micrologix 1400 (affected versions not specified) **Description** An issue was discovered where user credentials are sent to the web server in clear text. This may allow an attacker to discover the credentials if they are able to observe traffic between the web browser and the server. The vulnerability is related to the lack of protection for service data, which can be exploited by a remote attacker to obtain user credentials in unencrypted form by eavesdropping on traffic between the browser and the server. **Recommendations** For Rockwell Automation Allen-Bradley MicroLogix 1100 controller versions prior to 14.000, consider disabling web server access until a patch is available to prevent clear text transmission of user credentials. For Rockwell Automation Micrologix 1400, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Advantech WebAccess versions prior to 8.1 **Description** The issue allows remote authenticated users to execute arbitrary SQL commands. This is due to insufficient protection of the SQL query structure during authentication, which enables SQL code injection. Exploitation of this issue may allow a remote attacker to execute arbitrary SQL commands and modify web server settings, accounts, and projects. **Recommendations** For Advantech WebAccess versions prior to 8.1, update to version 8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL query structure to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Advantech WebAccess versions prior to 8.1 **Description** The issue is related to the external control of a file name or path in the Advantech WebAccess browser plugin, which can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For Advantech WebAccess versions prior to 8.1, update to version 8.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Yokogawa Electric Corporation FAST/TOOLS versions prior to R9.05-SP2 **Description** The issue is related to an XML external entity (XXE) vulnerability in the WebHMI server, which can be exploited by local users to cause a denial of service, resulting in CPU or network traffic consumption, or to read arbitrary files. **Recommendations** For versions prior to R9.05-SP2, update to version R9.05-SP2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 **Description** The issue concerns the use of weak encryption in the software, allowing local users to access sensitive information by reading a credential file. **Recommendations** For versions 4.0 SP1 through 5.5, update to a version that uses strong encryption to protect credential files.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 **Description** The issue allows remote attackers to execute arbitrary SQL commands. **Recommendations** For versions 4.0 SP1 through 5.5, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Siemens SIMATIC S7-1200 CPU PLC devices with firmware prior to 4.0 **Description** The issue allows remote attackers to cause a denial of service, resulting in the device transitioning to defect mode, which lasts until a hardware reset is performed. This is achieved by sending specially crafted PROFINET packets. **Recommendations** For Siemens SIMATIC S7-1200 CPU PLC devices with firmware prior to 4.0, update the firmware to version 4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Siemens SIMATIC S7-1200 CPU PLC devices versions prior to 4.0 **Description** A cross-site request forgery (CSRF) issue affects the software, allowing remote attackers to hijack the authentication of victims via unknown vectors. The vulnerability is also described as affecting the embedded server of the Simatic S7-1200 programmable logic controller, specifically on port 80 TCP and port 443 TCP, enabling cross-site request forgery. **Recommendations** For Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0, update the firmware to version 1.5.0 or later. For Siemens SIMATIC S7-1200 CPU PLC devices versions prior to 4.0, update the firmware to version 4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 **Description** The issue allows remote attackers to cause a denial of service, resulting in a defect-mode transition, by sending crafted Profinet packets. **Recommendations** For versions prior to 1.5.0, update the firmware to version 1.5.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 **Description** A cross-site scripting (XSS) issue exists in the integrated web server, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized access or control of the device. **Recommendations** For versions prior to 1.5.0, update the firmware to version 1.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the integrated web server until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 **Description** The issue concerns the random-number generator, which lacks sufficient entropy. This weakness can be exploited by remote attackers to bypass cryptographic protection mechanisms and hijack sessions. **Recommendations** For versions prior to 1.5.0, update the firmware to version 1.5.0 or later to address the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Database Server versions 11.1.0.7, 11.2.0.2, 11.2.0.3, and 12.1.0.1 **Description** The issue affects the confidentiality and availability of the system, but details about the vectors used for exploitation are not specified. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For Oracle Database Server version 11.1.0.7, update to a version that includes the fix for this issue. For Oracle Database Server version 11.2.0.2, update to a version that includes the fix for this issue. For Oracle Database Server version 11.2.0.3, update to a version that includes the fix for this issue. For Oracle Database Server version 12.1.0.1, update to a version that includes the fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel versions 2003 SP3, 2007 SP3, and 2010 SP1 and SP2 Excel Viewer Microsoft Office Compatibility Pack version SP3 **Description** An issue exists in the way Microsoft Excel parses specially crafted XML files, allowing remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference. This is related to an XML External Entity (XXE) issue, which is an information disclosure vulnerability. **Recommendations** For Microsoft Excel versions 2003 SP3, 2007 SP3, and 2010 SP1 and SP2, consider disabling the parsing of external entities in XML files until a patch is available. For Excel Viewer, restrict access to specially crafted XML files to minimize the risk of exploitation. For Microsoft Office Compatibility Pack version SP3, avoid using the affected XML parsing functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office versions 2003 SP3 through 2007 SP3 Word versions 2003 SP3 through 2007 SP3 Word Viewer (affected versions not specified) **Description** The issue is related to an XML External Entity (XXE) problem, where an XML document containing an external entity declaration in conjunction with an entity reference can be used to read arbitrary files. This occurs because of the way Microsoft Word parses specially crafted XML files containing external entities, leading to an information disclosure vulnerability. **Recommendations** For Microsoft Office versions 2003 SP3 through 2007 SP3, consider disabling the parsing of external entities in XML files as a temporary workaround until a patch is available. For Word versions 2003 SP3 through 2007 SP3, restrict access to specially crafted XML files to minimize the risk of exploitation. For Word Viewer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0 **Description** The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. **Recommendations** For versions 4.0 SP1 through 5.0, as a temporary workaround, consider restricting access to XML documents or disabling the processing of external entities until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Invensys Wonderware Win-XML Exporter version 1522.148.0.0 **Description** The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service through CPU and memory consumption. This is achieved via an XML external entity declaration in conjunction with an entity reference. **Recommendations** For Invensys Wonderware Win-XML Exporter version 1522.148.0.0, consider disabling XML external entity processing as a temporary workaround until a patch is available. Restrict access to sensitive files and intranet servers to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 **Description** The issue allows remote attackers to obtain sensitive information or cause a denial of service by using a crafted project file. **Recommendations** For Siemens WinCC versions prior to 7.2, update to version 7.2 or later. For SIMATIC PCS7 versions prior to 8.0 SP1, update to version 8.0 SP1 or later.