Ivan Kurnakov

The issue arises from the improper neutralization of special elements used in an OS command, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information.

Name of the Vulnerable Software and Affected Versions: CAMS for HIS CENTUM CS 3000 versions R3.08.10 through R3.09.50 CENTUM VP versions R4.01.00 through R6.07.00 B/M9000CS versions R5.04.01 through R5.05.01 B/M9000 VP versions R6.01.01 through R8.03.01 Description: The issue allows a remote unauthenticated attacker to bypass authentication and send altered communication packets. This is related to a lack of authentication when interacting via a specialized protocol, which can enable an unauthorized remote attacker to interact with the server. Recommendations: For CAMS for HIS CENTUM CS 3000 versions R3.08.10 through R3.09.50, update to a version outside of this range to mitigate the risk. For CENTUM VP versions R4.01.00 through R6.07.00, update to a version outside of this range to mitigate the risk. For B/M9000CS versions R5.04.01 through R5.05.01, update to a version outside of this range to mitigate the risk. For B/M9000 VP versions R6.01.01 through R8.03.01, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the specialized protocol to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: CAMS for HIS CENTUM CS 3000 versions R3.08.10 through R3.09.50 CAMS for HIS CENTUM VP versions R4.01.00 through R6.07.00 CAMS for HIS B/M9000CS versions R5.04.01 through R5.05.01 CAMS for HIS B/M9000 VP versions R6.01.01 through R8.03.01 Description: The issue is related to a directory traversal vulnerability in the CAMS for HIS component, which is associated with inadequate path name checking. This allows a remote unauthenticated attacker to create or overwrite arbitrary files and run arbitrary commands via unspecified vectors. Recommendations: For CAMS for HIS CENTUM CS 3000 versions R3.08.10 through R3.09.50, update to a version outside of this range to resolve the issue. For CAMS for HIS CENTUM VP versions R4.01.00 through R6.07.00, update to a version outside of this range to resolve the issue. For CAMS for HIS B/M9000CS versions R5.04.01 through R5.05.01, update to a version outside of this range to resolve the issue. For CAMS for HIS B/M9000 VP versions R6.01.01 through R8.03.01, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the CAMS for HIS component to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers (affected versions not specified) Description: The issue concerns a vulnerable hash algorithm used for password encryption in the communication modules of the mentioned controllers. This vulnerability makes the algorithm susceptible to hash collision attacks. Additionally, errors in the implementation of the cryptographic algorithm in the FTP server of the programmable logic controllers' firmware may allow a remote attacker to guess passwords. Recommendations: For all affected versions, consider disabling or restricting access to the vulnerable communication modules until a secure alternative or patch is available. As a temporary workaround, restrict access to the FTP server to minimize the risk of exploitation. Avoid using weak passwords and consider implementing additional security measures to protect against remote attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.