Alexey Stennikov

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns an insecure NTPT3 protocol in Ingenico Telium 2 POS terminals. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue is a buffer overflow that occurs via the `RemotePutFile` command of the NTPT3 protocol. This buffer overflow is fixed in Telium 2 SDK v9.32.03 patch N. Recommendations: For Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the `RemotePutFile` command of the NTPT3 protocol until the update is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns hardcoded FTP credentials in Ingenico Telium 2 POS terminals. This allows unauthorized access. The problem is fixed in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the FTP credentials until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue allows for arbitrary code execution via the TRACE protocol. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue is a buffer overflow via SOCKET TASK in the NTPT3 protocol. This buffer overflow can be exploited, but details about real-world incidents or the estimated number of potentially affected devices are not provided. The buffer overflow occurs in the NTPT3 protocol, which is used by the Ingenico Telium 2 POS terminals. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the SOCKET TASK in the NTPT3 protocol until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns undeclared TRACE protocol commands in Ingenico Telium 2 POS terminals. This problem is resolved in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS Telium2 OS versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue allows bypass of file-reading restrictions via the NTPT3 protocol. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns hardcoded PPP credentials in Ingenico Telium 2 POS terminals. This allows unauthorized access. The problem is resolved in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to fix the hardcoded PPP credentials issue.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns an insecure TRACE protocol in Ingenico Telium 2 POS terminals. This problem is resolved in Telium 2 SDK v9.32.03 patch N. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider disabling the TRACE protocol until the patch is applied.

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue is a buffer overflow via the 0x26 command of the NTPT3 protocol. This protocol is used in Ingenico Telium 2 POS terminals. The buffer overflow can be exploited, but details about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited are not provided. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N, update to Telium 2 SDK v9.32.03 patch N to resolve the issue. As a temporary workaround, consider restricting access to the 0x26 command of the NTPT3 protocol until the patch is applied.

Name of the Vulnerable Software and Affected Versions: NCR S1 Dispenser controller versions prior to 0x0156 Description: The issue is related to the memory write mechanism in the NCR S1 Dispenser controller, which lacks sufficient protection. This allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities. Exploitation of this issue may enable a remote attacker to execute arbitrary code or downgrade the device's firmware to an outdated version with known vulnerabilities. Recommendations: For versions prior to 0x0156, update the firmware to version 0x0156 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: NCR S2 Dispenser controller versions prior to 0x0108 NCR S1 Dispenser controller (affected versions not specified) Description: The issue is related to the memory write mechanism in the dispenser controller, which lacks sufficient protection. This allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities. The exploitation of this issue may enable a remote attacker to execute arbitrary code or downgrade the device's firmware to a version with known vulnerabilities. Recommendations: For NCR S2 Dispenser controller versions prior to 0x0108, update the firmware to version 0x0108 or later. For NCR S1 Dispenser controller, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers (affected versions not specified) Description: The issue concerns a vulnerable hash algorithm used for password encryption in the communication modules of the mentioned controllers. This vulnerability makes the algorithm susceptible to hash collision attacks. Additionally, errors in the implementation of the cryptographic algorithm in the FTP server of the programmable logic controllers' firmware may allow a remote attacker to guess passwords. Recommendations: For all affected versions, consider disabling or restricting access to the vulnerable communication modules until a secure alternative or patch is available. As a temporary workaround, restrict access to the FTP server to minimize the risk of exploitation. Avoid using weak passwords and consider implementing additional security measures to protect against remote attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon Premium versions (affected versions not specified) Schneider Electric Modicon Quantum PLC versions (affected versions not specified) Schneider Electric Modicon M340 versions (affected versions not specified) Schneider Electric Modicon BMXNOR0200 versions (affected versions not specified) Description: The issue is related to errors in the authentication mechanism of the embedded web server in the controllers, which can be exploited by an attacker to bypass authentication using specially crafted CGI requests. This allows malicious users to bypass authorization. Recommendations: For Schneider Electric Modicon Premium, update the authentication mechanism to prevent bypassing. For Schneider Electric Modicon Quantum PLC, restrict access to CGI functions until a patch is available. For Schneider Electric Modicon M340, consider disabling the web server functionality as a temporary workaround. For Schneider Electric Modicon BMXNOR0200, avoid using the vulnerable CGI functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.