Cyberdanube

The PROFINET service is affected by a buffer overflow, which occurs when a program writes more data to a block of memory than it can hold. This issue exists in the default configuration and allows an unauthenticated remote attacker to reboot the device or execute arbitrary code.

An unauthenticated denial-of-service issue exists in the PLCnext Engineer communication interface. A remote attacker can interrupt access via the client application, which prevents communication until the PLCnext service is manually restarted.

An authenticated attacker with low privileges can access an endpoint in the controller web interface that is vulnerable to SQL injection. This issue affects a SQLite database used exclusively for storing notification messages, limiting the impact to the system notification functionality.

A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command.