Anton Dorfman

The issue allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.

The issue is related to the use of hard-coded passwords in the software, allowing an unauthenticated attacker to disclose sensitive information. This can result in unauthenticated users being able to view programs and project files or execute programs illegally. The vulnerability can be exploited by a remote attacker to gain access to protected information.

The issue is related to the storage of sensitive information in cleartext, allowing a remote unauthenticated attacker to disclose this information. As a result, attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module.

The issue allows a remote unauthenticated attacker to disclose sensitive information due to the use of a hard-coded cryptographic key. This enables unauthenticated users to view programs and project files or execute programs illegally.

The issue allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project files or execute programs illegally.

The issue allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project files or execute programs illegally.

The issue is related to the cleartext storage of sensitive information in the programable logic controllers of the affected devices. This allows a remote unauthenticated attacker to disclose a file in a legitimate user's product by using previously eavesdropped cleartext information and to counterfeit a legitimate user’s system.

The issue is related to the use of a weak hash in the password storage mechanism, allowing a remote unauthenticated attacker to login to the product by using a password reversed from a previously eavesdropped password hash. This could potentially lead to unauthorized access to protected information.

The issue is related to the use of a password hash instead of a password for authentication, allowing a remote unauthenticated attacker to disclose or tamper with the information in the product by using an eavesdropped password hash.

The issue is related to the cleartext storage of sensitive information, specifically password hashes, in files. This allows a remote attacker to disclose or tamper with these files, potentially leading to privilege escalation. The vulnerability is associated with the unencrypted storage of credentials, which can be exploited by a remote attacker to gain elevated privileges using a file named 00000001.SYP.

The issue is related to an authentication bypass vulnerability using a capture-replay attack, allowing a remote unauthenticated attacker to login to the product. This can potentially enable the attacker to elevate their privileges.

The issue is related to the use of a password hash instead of the password for authentication, allowing a remote unauthenticated attacker to login to the product by replaying an eavesdropped password hash. This may enable an attacker to gain unauthorized access to protected information.

The issue is related to improper input validation, allowing a remote unauthenticated attacker to cause a DoS condition for the product's program execution or communication by sending specially crafted packets. System reset of the product is required for recovery.

The issue is related to improper input validation, allowing a remote unauthenticated attacker to cause a temporary denial of service condition for the product's communication by sending specially crafted packets. This can be exploited by sending a specially formed file, enabling an attacker to disrupt the service.

The issue is caused by a buffer copy without checking the size of the input, which can lead to a buffer overflow on the stack. This can allow a remote attacker to cause a denial of service.

The issue exists due to the reading of data beyond the boundaries of a specified buffer in the CODESYS Control V2 Linux SysFile library of the CODESYS industrial automation software complex. Exploitation of this issue may allow a remote attacker to cause a denial of service. The problem is caused by improper input validation.

The issue is caused by a buffer overflow in the dynamic memory of the CODESYS V2.3 web server, which is part of the CODESYS industrial automation software complex. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is described as a stack-based buffer overflow.

The issue is related to an out-of-bounds read in the CODESYS V2 Web-Server component of the CODESYS industrial automation software suite. This can be exploited by a remote attacker to disclose protected information and cause a denial of service.

The issue is caused by an out-of-bounds write, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. This is due to a buffer overflow in the dynamic memory of the CODESYS V2 web server component.

The issue is related to improper access control in the CODESYS V2 Web-Server, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. This is due to errors in security settings.