Francesco Sortino

The issue concerns the "Ethernet Q Commands" service in the Haas Controller, where authentication is currently unsupported. This allows any user on the same network segment as the controller, including those connected remotely, to access the service and write unauthorized macros to the device.

The issue is related to insufficient granularity of access control when using the "Ethernet Q Commands" service. This allows any user to write macros into registers outside of the authorized accessible range, potentially enabling access to privileged resources or resources out of context.

The issue concerns the transmission of communication traffic involving the "Ethernet Q Commands" service in cleartext. This allows an attacker to obtain sensitive information being passed to and from the controller.