Luca Borzacchiello

**Name of the Vulnerable Software and Affected Versions** CODESYS Control Runtime System (affected versions not specified) **Description** A remote attacker with limited privileges may be able to replace the boot application of the CODESYS Control runtime system. Successful exploitation could lead to unauthorized code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IKEA Dirigera version 2.866.4 **Description** A server-side request forgery (SSRF) condition exists in IKEA Dirigera version 2.866.4. This issue allows an attacker to potentially obtain private keys by sending a specially crafted request. The vulnerability involves the ability to make requests to unintended locations, potentially exposing sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal vulnerability exists in Productivity Suite software. This allows a remote, unauthenticated attacker to interact with the ProductivityService PLC simulator and create arbitrary directories on the target machine. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version v4.4.1.19 **Description** A weakness exists in the password recovery process. An attacker can decrypt an encrypted project by correctly answering a single recovery question. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal issue exists in Productivity Suite software. This allows a remote attacker who does not need to be authenticated to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal (ZipSlip) issue exists in Productivity Suite software. This allows an attacker who can modify a productivity project to potentially execute arbitrary code on the system where the project is opened. The vulnerability involves tampering with project files. **Recommendations** Update Productivity Suite to a version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal issue exists in Productivity Suite. This allows a remote, unauthenticated attacker to interact with the ProductivityService PLC simulator and write files containing arbitrary data to the target machine. **Recommendations** Update Productivity Suite to a newer version that resolves this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal vulnerability exists in Productivity Suite software version 4.4.1.19. This allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary files on the target machine. The vulnerability involves manipulating file paths to access and delete files outside the intended directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** A relative path traversal vulnerability exists in Productivity Suite software version 4.4.1.19. This allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary directories on the target machine. The vulnerability involves manipulating file paths to access and delete files outside the intended directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version v4.4.1.19 **Description** A flaw exists due to a binding to an unrestricted IP address in the ProductivityService PLC simulator. This allows an unauthenticated remote attacker to interact with the simulator. Successful exploitation can lead to the ability to read, write, or delete arbitrary files and folders on the affected system. **Recommendations** Update Productivity Suite to a newer version that resolves this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Productivity Suite version 4.4.1.19 **Description** An incorrect permission assignment for a critical resource exists in the software. This allows an attacker with low-privileged credentials to change their role, gaining full control access to the project. **Recommendations** Update Productivity Suite to a version with corrected permission assignments.

**Name of the Vulnerable Software and Affected Versions** CODESYS Runtime Toolkit-based products (affected versions not specified) **Description** CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS Control (affected versions not specified) **Description** A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system. This allows the attacker to read and write certificates and their keys, potentially enabling the extraction of sensitive data or the acceptance of certificates as trusted. If the certificates are deleted, only unencrypted communication is possible, while all services remain available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** An out-of-bounds write in the library allows an attacker to corrupt the memory of IO devices by sending a malicious RPC packet. This issue can be exploited by sending a specifically crafted packet to the affected devices. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider restricting access to the RPC endpoint until a patch is available. As a temporary workaround, avoid using the library to handle RPC packets from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** A Heap-based Buffer Overflow issue allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider restricting access to the RPC endpoint until a patch is available. As a temporary workaround, avoid using the library in IO devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** A heap-based buffer overflow in RT-Labs P-Net allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider restricting access to the library until a patch is available. As a temporary workaround, avoid using the RPC packet functionality in the affected library until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** A NULL Pointer Dereference in RT-Labs P-Net allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider updating to a version that fixes the NULL Pointer Dereference issue as soon as it becomes available. As a temporary workaround, consider restricting access to the RPC endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** A heap-based buffer overflow in the library allows an attacker to induce a crash in IO devices by sending a malicious RPC packet. This issue can be exploited by sending a specifically crafted packet to cause a denial of service. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider restricting access to the library until a patch is available. As a temporary workaround, avoid using the library in IO devices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** A heap-based buffer overflow in RT-Labs P-Net allows an attacker to corrupt the memory of IO devices that use the library by sending a malicious RPC packet. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider restricting access to the library until a patch is available. As a temporary workaround, avoid using the RPC packet functionality in the affected library until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RT-Labs P-Net versions 1.0.1 and earlier **Description** The issue is related to an Out-of-bounds Write that allows an attacker to induce a crash in IO devices using the library. This can be achieved by sending a malicious RPC packet. **Recommendations** For RT-Labs P-Net versions 1.0.1 and earlier, consider restricting access to the RPC endpoint until a patch is available to prevent the Out-of-bounds Write. At the moment, there is no information about a newer version that contains a fix for this vulnerability.