Vera Mens

OS command injection in the Dashboard Server interface allows an unauthenticated attacker with network access to the Dashboard Server port to craft commands that execute arbitrary code on the robot's operating system. This issue has been confirmed to be exploited in the wild and could lead to remote takeover of industrial robot fleets, potentially causing operational disruption, sabotage, or physical harm to humans. The risk is heightened in environments with poor network segmentation where attackers can move across operational technology (OT) fleets via exposed Ethernet connections on control boxes.

The issue allows an unauthenticated user to gather sensitive information through blind SQL injections.

The issue allows an unauthenticated user to access the Web Interface through an alternate path.

The issue concerns the improper storage or protection of web server admin credentials.

The issue allows an unauthenticated user to gain access and cause a denial-of-service condition or system disruption.

The issue could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.

The issue is a stack-based buffer overflow that could allow an attacker to gain code execution on the device. This can be exploited by an attacker to execute malicious code.

The issue concerns Vertiv products that do not properly protect webserver functions, potentially allowing an attacker to bypass authentication.

The issue is a NULL Dereference vulnerability that could allow a remote attacker to create a denial-of-service condition. This vulnerability affects Belledonne Communications Linphone-Desktop, allowing a remote attacker to exploit it and cause a denial-of-service condition.

A denial-of-service and possible remote code execution vulnerability exists in Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory, which may compromise system integrity, potentially allowing for remote code execution or a denial-of-service attack. The vulnerability is related to a buffer overflow in dynamic memory.

A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer overflow, potentially causing denial-of-service.

A device takeover issue exists, allowing the configuration of a new `Policyholder` user without authentication via API. The `Policyholder` user has the most privileges, enabling edit operations, creation of admin users, and factory resets. This can be exploited by sending a specially crafted API request to create a `Policyholder` user, potentially giving an attacker full access to the device.

Name of the Vulnerable Software and Affected Versions: PTC Kepware ThingWorx Kepware Server (affected versions not specified) Description: The issue arises when performing online tag generation to devices that communicate using the ControlLogix protocol. A machine-in-the-middle or a device that is not configured correctly could deliver a response leading to unrestricted or unregulated resource allocation. This could cause a denial-of-service condition and crash the Kepware application. By default, these functions are turned off, yet they remain accessible for users who recognize and require their advantages. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to weaknesses in the authentication procedure of Emerson Rosemount GC1500XA, GC700XA, and GC370XA products. An unauthenticated user with network access could bypass authentication and acquire admin capabilities, potentially allowing a remote attacker to compromise data integrity and cause a denial of service.

The issue allows an unauthenticated user with network access to execute arbitrary commands in root context from a remote computer. This is related to the failure to neutralize special elements used in the operating system command, which can be exploited by an attacker to execute arbitrary code by injecting it into the command 0x23 (Gunzip).

The issue is related to the lack of measures to neutralize special elements used in the operating system command. This could allow a remote attacker to execute arbitrary commands. An authenticated user with network access could run arbitrary commands from a remote computer.

An unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition due to insufficient authorization procedure in the software of Emerson Rosemount GC370XA, GC700XA, and GC1500XA products.

The issue is related to inadequate access control when handling Wi-Fi nodes, which could allow a remote attacker to elevate their privileges. Attackers within range can connect to the device's web services and compromise it.

The issue is related to the lack of authentication procedure for a critical function when processing MQTT messages, which can allow a remote attacker to gain unauthorized access to protected information. MachineSense devices use unauthenticated MQTT messaging to monitor devices and allow remote viewing of sensor data by users.

The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication.