Ilya Karpov

**Name of the Vulnerable Software and Affected Versions** AVEVA System Platform version 2020 **Description** The issue concerns the storage of sensitive information in cleartext, potentially allowing access to attackers or low-privileged users. **Recommendations** For AVEVA System Platform version 2020, consider implementing encryption for sensitive information to prevent unauthorized access. As a temporary workaround, restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa NPort IAW5000A-I/O series firmware versions 2.2 or earlier **Description** The issue is related to five buffer overflows in the built-in web server of the Moxa NPort IAW5000A-I/O series. This may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code. **Recommendations** For Moxa NPort IAW5000A-I/O series firmware versions 2.2 or earlier, update to a version later than 2.2 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa NPort IAW5000A-I/O Series firmware versions prior to 2.3 **Description** The issue is related to two buffer overflows in the built-in web server, which may allow a remote attacker to cause a denial-of-service condition. **Recommendations** For firmware versions 2.2 or earlier, update to version 2.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Moxa NPort IAW5000A-I/O series firmware versions prior to 2.3 **Description** The issue allows data to be copied without validation in the built-in web server, potentially enabling a remote attacker to cause denial-of-service conditions. **Recommendations** For Moxa NPort IAW5000A-I/O series firmware versions prior to 2.3, update to firmware version 2.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Moxa NPort IAW5000A-I/O series firmware versions 2.2 or earlier **Description** The issue is related to improper input validation in the built-in web server, which may allow a remote attacker to execute commands. **Recommendations** For Moxa NPort IAW5000A-I/O series firmware versions 2.2 or earlier, update to a version later than 2.2 to resolve the issue. As a temporary workaround, consider restricting access to the built-in web server until a patch is available.

**Name of the Vulnerable Software and Affected Versions** AVEVA InTouch Runtime versions prior to 2020 R2 **Description** The issue could expose cleartext credentials if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location. **Recommendations** For versions prior to 2020 R2, ensure that diagnostic memory dumps are saved to protected locations to prevent unauthorized access to cleartext credentials. As a temporary workaround, consider restricting access to the diagnostic memory dump feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MOXA NPort IAW5000A-I/O firmware versions 2.1 or lower **Description** The issue concerns the storage and transmission of credentials for third-party services in cleartext by the built-in WEB server. This affects the confidentiality of the credentials, as they can be easily intercepted or accessed. **Recommendations** For MOXA NPort IAW5000A-I/O firmware versions 2.1 or lower, update to a version higher than 2.1 to resolve the issue. As a temporary workaround, consider restricting access to the built-in WEB server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MOXA NPort IAW5000A-I/O firmware versions 2.1 or lower **Description** The issue concerns the built-in WEB server, which has incorrectly implemented protections from session fixation. This may allow an attacker to gain access to a session and hijack it by stealing the user's cookies. **Recommendations** For MOXA NPort IAW5000A-I/O firmware versions 2.1 or lower, update to a version higher than 2.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MOXA NPort IAW5000A-I/O firmware versions 2.1 or lower **Description** The issue concerns improper privilege management in the built-in WEB server, potentially allowing an attacker with user privileges to perform requests with administrative privileges. **Recommendations** For MOXA NPort IAW5000A-I/O firmware versions 2.1 or lower, consider restricting access to the built-in WEB server until a fix is available, and limit user privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Easergy T300 versions 2.7 and older **Description** A Missing Encryption of Sensitive Data issue exists, allowing an attacker to read network traffic over the HTTP protocol. **Recommendations** For Easergy T300 versions 2.7 and older, consider disabling HTTP protocol usage until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Easergy T300 versions 2.7 and older **Description** The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to perform arbitrary actions. This is due to improper restriction of rendered UI layers or frames, allowing an attacker to trick a user into initiating an unintended action. **Recommendations** For versions 2.7 and older, update the firmware to a version newer than 2.7 to resolve the issue. As a temporary workaround, consider restricting access to the user interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MOXA NPort IAW5000A-I/O firmware versions 2.1 and lower **Description** The issue is related to the implementation of SSH/Telnet protocols in the MOXA NPort IAW5000A-I/O Series web server software, which lacks sufficient restrictions on authentication attempts. This may allow a remote attacker to bypass security restrictions through brute force attacks. **Recommendations** For MOXA NPort IAW5000A-I/O firmware versions 2.1 and lower, consider restricting or disabling SSH/Telnet sessions as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rockwell Automation MicroLogix 1400 Controllers Series B versions 21.001 and prior Rockwell Automation MicroLogix 1400 Controllers Series A, all versions MicroLogix 1100 Controller, all versions RSLogix 500 Software versions 12.001 and prior **Description** The issue is related to the use of a hard-coded cryptographic key in the RSLogix 500 binary file, which could allow an attacker to identify the key and use it for further cryptographic attacks. This could ultimately lead to a remote attacker gaining unauthorized access to the controller. The vulnerability may allow a remote attacker to elevate their privileges. **Recommendations** For Rockwell Automation MicroLogix 1400 Controllers Series B versions 21.001 and prior, consider restricting access to the controller until a patch is available. For Rockwell Automation MicroLogix 1400 Controllers Series A, all versions, and MicroLogix 1100 Controller, all versions, restrict access to the controller to minimize the risk of exploitation. For RSLogix 500 Software versions 12.001 and prior, as a temporary workaround, consider disabling the use of the hard-coded cryptographic key until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 through 1.34 **Description** The WebUI of the affected device is susceptible to a denial-of-service attack. This can be achieved by establishing more than 120 connections. **Recommendations** For versions 1.0 through 1.34, consider restricting the number of connections to the WebUI to prevent denial-of-service attacks. As a temporary workaround, limit the number of concurrent connections to mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 through 1.34 **Description** The WebUI of the affected devices allows for plaintext transmission of user credentials by default, which can be done over HTTP. **Recommendations** For versions 1.0 through 1.34, consider configuring the WebUI to use encrypted transmission, such as HTTPS, to protect user credentials. As a temporary workaround, restrict access to the WebUI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 through 1.34 **Description** The WebUI of the affected devices leaks private information in firmware images. **Recommendations** For versions 1.0 through 1.34, consider restricting access to the WebUI to minimize the risk of information leakage until a fix is available.

**Name of the Vulnerable Software and Affected Versions** PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 **Description** The WebUI of the affected device is susceptible to brute-force attacks due to improper restriction of excessive authentication attempts. This allows attackers to attempt numerous login combinations without significant impediment. **Recommendations** For versions prior to 1.35, update to version 1.35 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebUI or implementing additional authentication measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric Ampla MES versions prior to 6.5 **Description** A weakness in the password hashing algorithm of Schneider Electric Ampla MES could be exploited to reverse a user's password when Simple Security is used. **Recommendations** For versions prior to 6.5, upgrade to Ampla MES version 6.5 as soon as possible.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers (affected versions not specified) **Description** The issue is related to hard-coded accounts in the communication modules of the affected controllers. This concern is also associated with the FTP server vulnerability in the programmable logic controllers' firmware, which involves the use of pre-set credentials. Exploitation of this issue could allow a remote attacker to gain access to the device. **Recommendations** For all affected versions, consider disabling or restricting access to the FTP server and communication modules until a fix is available. As a temporary workaround, restrict access to the devices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS (affected versions not specified) **Description** An authorization bypass issue exists in the integrated web server of the affected devices, allowing a remote attacker to gain full access to the device by bypassing the authorization system. The vulnerability is related to insufficient access control in the web server, which could enable a remote attacker to bypass authentication and obtain full control over the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.