Aditya K. Sood

Name of the Vulnerable Software and Affected Versions: KACO New Energy XP100U versions up to XP-JAVA 2.0 Description: The issue is related to incorrect access control, where credentials are always returned in plain-text from the local server during the authentication process, regardless of the provided passwords. This leads to an information disclosure issue. Recommendations: For KACO New Energy XP100U versions up to XP-JAVA 2.0, consider restricting access to the authentication process to minimize the risk of exploitation. As a temporary workaround, avoid using the plain-text credential return feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric Modicon BMXNOC0401 Schneider Electric Modicon BMXNOE0100 Schneider Electric Modicon BMXNOE0110 Schneider Electric Modicon BMXNOE0110H Schneider Electric Modicon BMXNOR0200H Schneider Electric Modicon BMXP342020 Schneider Electric Modicon BMXP342020H Schneider Electric Modicon BMXP342030 Schneider Electric Modicon BMXP3420302 Schneider Electric Modicon BMXP3420302H Schneider Electric Modicon BMXP342030H **Description** The issue allows an attacker to craft a specific URL referencing the PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page. This is related to remote file inclusion. **Recommendations** For each of the affected Schneider Electric Modicon devices, consider restricting access to the web server as a temporary workaround until a patch is available. Avoid using the PLC web server for sensitive operations until the issue is resolved. As a temporary mitigation measure, consider disabling Java script loading in the web page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric Modicon BMXNOC0401 Schneider Electric Modicon BMXNOE0100 Schneider Electric Modicon BMXNOE0110 Schneider Electric Modicon BMXNOE0110H Schneider Electric Modicon BMXNOR0200H Schneider Electric Modicon BMXP342020 Schneider Electric Modicon BMXP342020H Schneider Electric Modicon BMXP342030 Schneider Electric Modicon BMXP3420302 Schneider Electric Modicon BMXP3420302H Schneider Electric Modicon BMXP342030H **Description** The issue allows an attacker to craft a specific URL that contains JavaScript, which will be executed on the client browser of the PLC. This is a Reflected Cross-Site Scripting (nonpersistent) issue. **Recommendations** For each of the affected devices, apply the recommended patch or update from Schneider Electric to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) versions 2.0.29.11 and prior **Description** A cross-site request forgery condition can occur, allowing an attacker to change passwords of the device remotely. This issue is related to the exploitation of a vulnerability that may enable a remote attacker to modify the device's password. **Recommendations** For versions 2.0.29.11 and prior, consider changing the password regularly and restricting remote access to the device until a fix is available. As a temporary workaround, restrict access to the device's web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) versions 2.0.29.11 and prior **Description** The issue is related to insufficient protection of configuration data, allowing unauthorized access to configuration files and profiles without proper user authentication. This could enable a remote attacker to gain unauthorized access to these sensitive data. **Recommendations** For versions 2.0.29.11 and prior, update the firmware to a version that addresses this issue, as no specific workaround or mitigation is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) versions 2.0.29.11 and prior **Description** The issue is related to the disclosure of information through directory listing without authentication. This allows a remote attacker to gain unauthorized access to protected data by reading the device's directory files. **Recommendations** For versions 2.0.29.11 and prior, consider restricting access to the device's directory to minimize the risk of exploitation. As a temporary workaround, limit remote access to the device until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) versions 2.0.29.11 and prior **Description** The issue is related to the device's vulnerability to cross-site scripting attacks, which allows a remote attacker to run arbitrary code on the device. This is due to the lack of protection for the web page structure, enabling an attacker to execute arbitrary JavaScript code in the user's browser. **Recommendations** For versions 2.0.29.11 and prior, as a temporary workaround, consider restricting access to the web interface of the device until a patch is available. Avoid using the device's web interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visonic PowerLink2 versions prior to October 2016 firmware release **Description** An issue was discovered where accessing a specific URL to an image results in the exposure of source code used in the web server. **Recommendations** For versions prior to October 2016 firmware release, update to the October 2016 firmware release or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adcon Telemetry A850 Telemetry Gateway Base Station (affected versions not specified) **Description** The issue is related to the Web Interface of the affected software, where it fails to properly neutralize user-controllable input. This could lead to cross-site scripting, allowing potential attackers to inject malicious scripts into the output. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visonic PowerLink2 versions prior to October 2016 firmware release **Description** An issue was discovered where user-controlled input is not neutralized prior to being placed in web page output, leading to a CROSS-SITE SCRIPTING issue. **Recommendations** For versions prior to the October 2016 firmware release, update to the October 2016 firmware release or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adcon Telemetry A840 Telemetry Gateway Base Station (affected versions not specified) **Description** The issue is related to hardcoded credentials in the software, allowing remote attackers to gain administrative access. The vulnerability exists due to the hardcoding of registration data, which can be exploited by a remote attacker to obtain administrator rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adcon Telemetry A840 Telemetry Gateway Base Station (affected versions not specified) **Description** The issue allows remote attackers to obtain sensitive information by sniffing the network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adcon Telemetry A840 Telemetry Gateway Base Station (affected versions not specified) **Description** The issue concerns the Java client in the Adcon Telemetry A840 Telemetry Gateway Base Station, which fails to authenticate station devices. This lack of authentication allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data. The problem is related to the absence of SSL support. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MOSCAD IP Gateway (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that modify a password. This can be achieved through specific API endpoints, although the exact endpoints are not specified. The issue does not provide details on the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MOSCAD IP Gateway (affected versions not specified) **Description** The issue allows remote attackers to read arbitrary files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.