Benedikt Kühne

Name of the Vulnerable Software and Affected Versions: Elspec Engineering G5 Digital Fault Recorder Firmware version 1.2.1.12 Description: The issue is related to an XML External Entity (XXE) vulnerability, which allows attackers to cause a Denial of Service (DoS) via a crafted XML payload. This vulnerability can be exploited by sending a manipulated XML payload to the affected system. Recommendations: For Elspec Engineering G5 Digital Fault Recorder Firmware version 1.2.1.12, consider disabling the XML parsing functionality until a patch is available to prevent potential Denial of Service (DoS) attacks. Restrict access to the firmware to minimize the risk of exploitation. Avoid using the firmware with untrusted XML inputs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Elspec Engineering G5 Digital Fault Recorder Firmware version 1.2.1.12 Description: A buffer overflow issue was discovered in the firmware. Recommendations: For Elspec Engineering G5 Digital Fault Recorder Firmware version 1.2.1.12, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.2.1.12 and earlier Description: An issue was discovered that may allow an attacker to cause a Denial of Service (DoS) via a crafted XML payload due to an XML External Entity (XXE) vulnerability. Recommendations: For versions 1.2.1.12 and earlier, as a temporary workaround, consider disabling the processing of external XML entities until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability has been identified in the Modbus TCP interface of the Siemens SENTRON 7KM PAC3200, where affected devices only provide a 4-digit PIN to protect from administrative access. This insufficient protection allows attackers with access to the Modbus TCP interface to bypass it by brute-force attacks or by sniffing the Modbus clear text communication. The issue is related to improper authentication, specifically the use of a weak 4-digit PIN and the lack of encryption in the Modbus protocol.

An issue in the Elspec G5 digital fault recorder allows unauthenticated memory corruption to occur during XML body parsing.

An issue was discovered in the HTTP header parsing mechanism, allowing unauthenticated memory corruption to occur.

An issue was discovered that allows unauthenticated directory listing to occur. The web interface can be abused by an attacker to gain a better understanding of the operating system.

An issue was discovered where cleartext passwords and hashes are exposed through log files.

An issue was discovered in the Elspec G5 digital fault recorder where the shadow file is world readable.

An issue was discovered in the Elspec G5 digital fault recorder. A hardcoded backdoor session ID exists that can be used for further access to the device, including reconfiguration tasks.

The issue concerns weak permissions of the SQLite database file.

An issue in the Elspec G5 digital fault recorder allows privilege escalation via world writable files. The network configuration script has weak filesystem permissions, resulting in write access for all authenticated users and the possibility to escalate from user privileges to administrative privileges.

An issue was discovered in the system logs download mechanism, allowing directory traversal to occur. This could potentially expose system logs. If local network access exists, it is recommended to take immediate action to prevent data breaches.

The package authelia-bhf included in Beckhoff's TwinCAT/BSD is prone to an open redirect, allowing a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect anthelia-bhf, the Beckhoff fork of authelia. The vulnerability can be exploited by sending a specially crafted HTTP request, enabling the attacker to redirect the user to arbitrary websites.