Luca Borzacchiello

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.

**Name of the Vulnerable Software and Affected Versions** CODESYS Control Runtime System (affected versions not specified) **Description** A remote attacker with limited privileges may be able to replace the boot application of the CODESYS Control runtime system. Successful exploitation could lead to unauthorized code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IKEA Dirigera version 2.866.4 **Description** A server-side request forgery (SSRF) condition exists in IKEA Dirigera version 2.866.4. This issue allows an attacker to potentially obtain private keys by sending a specially crafted request. The vulnerability involves the ability to make requests to unintended locations, potentially exposing sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal issue exists in Productivity Suite. This allows a remote, unauthenticated attacker to interact with the ProductivityService PLC simulator and write files containing arbitrary data to the target machine. **Recommendations** Update Productivity Suite to a newer version that resolves this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal vulnerability exists in Productivity Suite software version 4.4.1.19. This allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary directories on the target machine. The vulnerability involves manipulating file paths to access and delete files outside the intended directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** An incorrect permission assignment for a critical resource exists in the software. This allows an attacker with low-privileged credentials to change their role, gaining full control access to the project. **Recommendations** Update Productivity Suite to a version with corrected permission assignments.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version v4.4.1.19 **Description** A weakness exists in the password recovery process. An attacker can decrypt an encrypted project by correctly answering a single recovery question. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version v4.4.1.19 **Description** A flaw exists due to a binding to an unrestricted IP address in the ProductivityService PLC simulator. This allows an unauthenticated remote attacker to interact with the simulator. Successful exploitation can lead to the ability to read, write, or delete arbitrary files and folders on the affected system. **Recommendations** Update Productivity Suite to a newer version that resolves this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal vulnerability exists in Productivity Suite software. This allows a remote, unauthenticated attacker to interact with the ProductivityService PLC simulator and create arbitrary directories on the target machine. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal issue exists in Productivity Suite software. This allows a remote attacker who does not need to be authenticated to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal vulnerability exists in Productivity Suite software version 4.4.1.19. This allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary files on the target machine. The vulnerability involves manipulating file paths to access and delete files outside the intended directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal (ZipSlip) issue exists in Productivity Suite software. This allows an attacker who can modify a productivity project to potentially execute arbitrary code on the system where the project is opened. The vulnerability involves tampering with project files. **Recommendations** Update Productivity Suite to a version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS Control (affected versions not specified) **Description** A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system. This allows the attacker to read and write certificates and their keys, potentially enabling the extraction of sensitive data or the acceptance of certificates as trusted. If the certificates are deleted, only unencrypted communication is possible, while all services remain available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS Runtime Toolkit-based products (affected versions not specified) **Description** CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** A Heap-based Buffer Overflow issue allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider restricting access to the RPC endpoint until a patch is available. As a temporary workaround, avoid using the library in IO devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.