Stefan Viehböck

Name of the Vulnerable Software and Affected Versions: SIPROTEC 5 6MD84 (CP300) (All versions) SIPROTEC 5 6MD85 (CP200) (All versions) SIPROTEC 5 6MD85 (CP300) (All versions) SIPROTEC 5 6MD86 (CP200) (All versions) SIPROTEC 5 6MD86 (CP300) (All versions) SIPROTEC 5 6MD89 (CP300) (All versions) SIPROTEC 5 6MU85 (CP300) (All versions) SIPROTEC 5 7KE85 (CP200) (All versions) SIPROTEC 5 7KE85 (CP300) (All versions) SIPROTEC 5 7SA82 (CP100) (All versions) SIPROTEC 5 7SA82 (CP150) (All versions) SIPROTEC 5 7SA86 (CP200) (All versions) SIPROTEC 5 7SA86 (CP300) (All versions) SIPROTEC 5 7SA87 (CP200) (All versions) SIPROTEC 5 7SA87 (CP300) (All versions) SIPROTEC 5 7SD82 (CP100) (All versions) SIPROTEC 5 7SD82 (CP150) (All versions) SIPROTEC 5 7SD86 (CP200) (All versions) SIPROTEC 5 7SD86 (CP300) (All versions) SIPROTEC 5 7SD87 (CP200) (All versions) SIPROTEC 5 7SD87 (CP300) (All versions) SIPROTEC 5 7SJ81 (CP100) (All versions) SIPROTEC 5 7SJ81 (CP150) (All versions) SIPROTEC 5 7SJ82 (CP100) (All versions) SIPROTEC 5 7SJ82 (CP150) (All versions) SIPROTEC 5 7SJ85 (CP200) (All versions) SIPROTEC 5 7SJ85 (CP300) (All versions) SIPROTEC 5 7SJ86 (CP200) (All versions) SIPROTEC 5 7SJ86 (CP300) (All versions) SIPROTEC 5 7SK82 (CP100) (All versions) SIPROTEC 5 7SK82 (CP150) (All versions) SIPROTEC 5 7SK85 (CP200) (All versions) SIPROTEC 5 7SK85 (CP300) (All versions) SIPROTEC 5 7SL82 (CP100) (All versions) SIPROTEC 5 7SL82 (CP150) (All versions) SIPROTEC 5 7SL86 (CP200) (All versions) SIPROTEC 5 7SL86 (CP300) (All versions) SIPROTEC 5 7SL87 (CP200) (All versions) SIPROTEC 5 7SL87 (CP300) (All versions) SIPROTEC 5 7SS85 (CP200) (All versions) SIPROTEC 5 7SS85 (CP300) (All versions) SIPROTEC 5 7ST85 (CP200) (All versions) SIPROTEC 5 7ST85 (CP300) (All versions) SIPROTEC 5 7ST86 (CP300) (All versions) SIPROTEC 5 7SX82 (CP150) (All versions) SIPROTEC 5 7SX85 (CP300) (All versions) SIPROTEC 5 7SY82 (CP150) (All versions) SIPROTEC 5 7UM85 (CP300) (All versions) SIPROTEC 5 7UT82 (CP100) (All versions) SIPROTEC 5 7UT82 (CP150) (All versions) SIPROTEC 5 7UT85 (CP200) (All versions) SIPROTEC 5 7UT85 (CP300) (All versions) SIPROTEC 5 7UT86 (CP200) (All versions) SIPROTEC 5 7UT86 (CP300) (All versions) SIPROTEC 5 7UT87 (CP200) (All versions) SIPROTEC 5 7UT87 (CP300) (All versions) SIPROTEC 5 7VE85 (CP300) (All versions) SIPROTEC 5 7VK87 (CP200) (All versions) SIPROTEC 5 7VK87 (CP300) (All versions) SIPROTEC 5 7VU85 (CP300) (All versions) SIPROTEC 5 Compact 7SX800 (CP050) (All versions) Description: The affected devices do not encrypt certain data within the on-board flash storage on their PCB. This could allow an attacker with physical access to read the entire filesystem of the device. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SIPROTEC 5 6MD84 (CP300) versions prior to V9.90 SIPROTEC 5 6MD85 (CP200) versions prior to V9.90 SIPROTEC 5 6MD85 (CP300) versions prior to V9.90 SIPROTEC 5 6MD86 (CP200) versions prior to V9.90 SIPROTEC 5 6MD86 (CP300) versions prior to V9.90 SIPROTEC 5 6MD89 (CP300) versions prior to V9.90 SIPROTEC 5 6MU85 (CP300) versions prior to V9.90 SIPROTEC 5 7KE85 (CP200) versions prior to V9.90 SIPROTEC 5 7KE85 (CP300) versions prior to V9.90 SIPROTEC 5 7SA82 (CP100) versions prior to V9.90 SIPROTEC 5 7SA82 (CP150) versions prior to V9.90 SIPROTEC 5 7SA86 (CP200) versions prior to V9.90 SIPROTEC 5 7SA86 (CP300) versions prior to V9.90 SIPROTEC 5 7SA87 (CP200) versions prior to V9.90 SIPROTEC 5 7SA87 (CP300) versions prior to V9.90 SIPROTEC 5 7SD82 (CP100) versions prior to V9.90 SIPROTEC 5 7SD82 (CP150) versions prior to V9.90 SIPROTEC 5 7SD86 (CP200) versions prior to V9.90 SIPROTEC 5 7SD86 (CP300) versions prior to V9.90 SIPROTEC 5 7SD87 (CP200) versions prior to V9.90 SIPROTEC 5 7SD87 (CP300) versions prior to V9.90 SIPROTEC 5 7SJ81 (CP100) versions prior to V9.90 SIPROTEC 5 7SJ81 (CP150) versions prior to V9.90 SIPROTEC 5 7SJ82 (CP100) versions prior to V9.90 SIPROTEC 5 7SJ82 (CP150) versions prior to V9.90 SIPROTEC 5 7SJ85 (CP200) versions prior to V9.90 SIPROTEC 5 7SJ85 (CP300) versions prior to V9.90 SIPROTEC 5 7SJ86 (CP200) versions prior to V9.90 SIPROTEC 5 7SJ86 (CP300) versions prior to V9.90 SIPROTEC 5 7SK82 (CP100) versions prior to V9.90 SIPROTEC 5 7SK82 (CP150) versions prior to V9.90 SIPROTEC 5 7SK85 (CP200) versions prior to V9.90 SIPROTEC 5 7SK85 (CP300) versions prior to V9.90 SIPROTEC 5 7SL82 (CP100) versions prior to V9.90 SIPROTEC 5 7SL82 (CP150) versions prior to V9.90 SIPROTEC 5 7SL86 (CP200) versions prior to V9.90 SIPROTEC 5 7SL86 (CP300) versions prior to V9.90 SIPROTEC 5 7SL87 (CP200) versions prior to V9.90 SIPROTEC 5 7SL87 (CP300) versions prior to V9.90 SIPROTEC 5 7SS85 (CP200) versions prior to V9.90 SIPROTEC 5 7SS85 (CP300) versions prior to V9.90 SIPROTEC 5 7ST85 (CP200) versions prior to V9.90 SIPROTEC 5 7ST85 (CP300) versions prior to V9.90 SIPROTEC 5 7ST86 (CP300) versions prior to V9.90 SIPROTEC 5 7SX82 (CP150) versions prior to V9.90 SIPROTEC 5 7SX85 (CP300) versions prior to V9.90 SIPROTEC 5 7SY82 (CP150) versions prior to V9.90 SIPROTEC 5 7UM85 (CP300) versions prior to V9.90 SIPROTEC 5 7UT82 (CP100) versions prior to V9.90 SIPROTEC 5 7UT82 (CP150) versions prior to V9.90 SIPROTEC 5 7UT85 (CP200) versions prior to V9.90 SIPROTEC 5 7UT85 (CP300) versions prior to V9.90 SIPROTEC 5 7UT86 (CP200) versions prior to V9.90 SIPROTEC 5 7UT86 (CP300) versions prior to V9.90 SIPROTEC 5 7UT87 (CP200) versions prior to V9.90 SIPROTEC 5 7UT87 (CP300) versions prior to V9.90 SIPROTEC 5 7VE85 (CP300) versions prior to V9.90 SIPROTEC 5 7VK87 (CP200) versions prior to V9.90 SIPROTEC 5 7VK87 (CP300) versions prior to V9.90 SIPROTEC 5 7VU85 (CP300) versions prior to V9.90 SIPROTEC 5 Compact 7SX800 (CP050) versions prior to V9.90 Description: The affected devices do not properly limit access to a development shell accessible over a physical interface. This could allow an unauthenticated attacker with physical access to the device to execute arbitrary commands on the device. Recommendations: For SIPROTEC 5 6MD84 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 6MD85 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 6MD85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 6MD86 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 6MD86 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 6MD89 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 6MU85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7KE85 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7KE85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SA82 (CP100) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SA82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SA86 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SA86 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SA87 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SA87 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SD82 (CP100) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SD82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SD86 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SD86 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SD87 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SD87 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ81 (CP100) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ81 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ82 (CP100) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ85 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ86 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SJ86 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SK82 (CP100) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SK82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SK85 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SK85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SL82 (CP100) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SL82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SL86 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SL86 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SL87 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SL87 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SS85 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SS85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7ST85 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7ST85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7ST86 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SX82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SX85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7SY82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UM85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT82 (CP100) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT82 (CP150) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT85 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT86 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT86 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT87 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7UT87 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7VE85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7VK87 (CP200) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7VK87 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 7VU85 (CP300) versions prior to V9.90, update to version V9.90 or later. For SIPROTEC 5 Compact 7SX800 (CP050) versions prior to V9.90, update to version V9.90 or later.

The affected devices do not properly limit the path accessible via their webserver, allowing an authenticated remote attacker to read arbitrary files from the filesystem of affected devices.

Name of the Vulnerable Software and Affected Versions: CPCI85 Central Processing/Communication versions prior to V05.30 Description: A vulnerability has been identified in the CPCI85 Central Processing/Communication devices. The affected devices contain a secure element connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files. Recommendations: For versions prior to V05.30, consider restricting physical access to the SPI bus as a temporary mitigation measure until a patch is available. Additionally, avoid using the secure element for authentication until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CPCI85 Central Processing/Communication versions prior to V5.40 SICORE Base system versions prior to V1.4.0 Description: A vulnerability has been identified that allows a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities. The issue is related to the lack of authentication for a critical function, which can be exploited by a remote attacker to lower the device's firmware version. Recommendations: For CPCI85 Central Processing/Communication versions prior to V5.40, update to version V5.40 or later to resolve the issue. For SICORE Base system versions prior to V1.4.0, update to version V1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting physical access to the devices and limiting remote access to authenticated users only until a patch is applied.

Name of the Vulnerable Software and Affected Versions: CPCI85 Central Processing/Communication versions prior to V5.30 SICORE Base system versions prior to V1.3.0 Description: A command injection vulnerability exists due to missing server-side input sanitation in the web interface of affected devices. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges. Recommendations: For CPCI85 Central Processing/Communication versions prior to V5.30, update to version V5.30 or later. For SICORE Base system versions prior to V1.3.0, update to version V1.3.0 or later. As a temporary workaround, consider restricting access to the web interface of affected devices to minimize the risk of exploitation.

A vulnerability has been identified that involves an exposed UART console login interface. This issue could allow an attacker with direct physical access to attempt bruteforcing or cracking the root password to gain login access to the device. The vulnerability is related to the web server software of the Siemens SICAM processor control modules, specifically affecting the CP-8031 and CP-8050 models. Exploitation of this vulnerability may enable an attacker to elevate their privileges to the root level.

A vulnerability has been identified that involves the use of hard-coded credentials in the firmware of the affected devices. This could allow an attacker with direct physical access to exploit the vulnerability for UART console login to the device, potentially leading to privilege escalation.

A vulnerability has been identified in the web interface of affected devices due to missing server-side input sanitation, making it vulnerable to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

The issue is related to insufficient argument checking in the web server of the Siemens SICAM CP-8031 and CP-8050 processor control modules. This can be exploited by a remote attacker to execute arbitrary commands via the web server port 443/tcp if the `Remote Operation` parameter is enabled. By default, the `Remote Operation` parameter is disabled. The vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the device.

A path traversal issue affects jefferson's JFFS2 filesystem extractor. Attackers can craft malicious JFFS2 files to force jefferson to write outside of the extraction directory.

The vulnerability is related to insufficient protection of the web interface structure in Barracuda CloudGen WAN when handling the `/ajax/update certificate` endpoint. Exploitation of this issue may allow a remote attacker to execute arbitrary commands by sending specially crafted HTTP requests. For example, a `name` field can contain `:password` and a `password` field can contain shell metacharacters.

The issue concerns the use of hard-coded cryptographic keys in the devices.

The issue allows an attacker to use an undocumented user account `default` with its default password to login to XMeye and access or view video streams.

A privilege escalation issue affects the devices, allowing attackers to access the command line interface (CLI) if it was previously disabled by the ISP, escalate privileges, and conduct further attacks.

The issue is related to weaknesses in the authentication procedure of the http module for libmtk, which is used in WiMAX routers based on the MediaTek SDK. This allows a remote attacker to bypass authentication and gain administrator access to the device. The exploitation involves sending a specially crafted POST request to the `commit2.cgi` script with a new password in the `ADMIN POST` parameter, effectively changing the administrator password.

The issue is caused by a stack-based buffer overflow in the `run init sbus` function of the NetUSB driver. This can be exploited by a remote attacker using a specially crafted TCP packet containing a long computer name (at least 64 bytes) to execute arbitrary code. The vulnerability can be triggered through a session on TCP port 20005.

The issue is related to a directory traversal vulnerability that allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH INFO to "login/". This can be exploited to bypass authentication procedures and read or write arbitrary files in the system. The vulnerability is due to incorrect restriction of the path name to a directory with limited access.

A cross-site scripting (XSS) issue exists in the ajaxswing webui component of the Management Console server. This allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

The issue allows remote attackers to gain login access by leveraging knowledge of a password hash, as the system performs authentication with a password hash instead of a password.