Manuel Stotz

**Name of the Vulnerable Software and Affected Versions** Product (affected versions not specified) **Description** The product is vulnerable to remote code execution due to missing input validation during one step of the firmware update process. An attacker with network access and the user level "Service" can execute arbitrary system commands in the root user's context. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned. **Description** The authentication process to the web server uses a challenge response procedure that includes a nonce and additional information. This challenge can be reused multiple times for login, making it vulnerable to a replay attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AppManager (affected versions not specified) **Description** The issue allows Lua apps to be deployed, removed, started, reloaded, or stopped without authorization via AppManager. This enables an attacker to remove legitimate apps, creating a denial-of-service (DoS) attack, read and write files, or load apps that utilize all features of the product available to a customer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CROWN (affected versions not specified) **Description** The issue allows unauthenticated access to critical functions through CROWN APIs, making large parts of the web application accessible without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SICK InspectorP61x versions (affected versions not specified) SICK InspectorP62x versions (affected versions not specified) SICK TiM3xx versions (affected versions not specified) **Description** The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device. **Recommendations** For SICK InspectorP61x, consider disabling access to hidden user levels until a patch is available. For SICK InspectorP62x, restrict access to the device to minimize the risk of exploitation. For SICK TiM3xx, avoid using hardcoded credentials for hidden user levels until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Device (affected versions not specified) **Description** The issue arises from unvalidated firmware updates, allowing an attacker to install modified firmware on the device. This has a significant impact on availability, integrity, and confidentiality, potentially leading to the complete compromise of the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UCI IDOL 2 versions through 2.12 **Description** An issue was discovered in UCI IDOL 2 due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer. This makes IDOL2 vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution via the `xB0x00x3c` byte sequence. **Recommendations** For versions through 2.12, consider disabling the functionality that allows deserialization of user-input data until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the vulnerable byte sequence `xB0x00x3c` in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UCI IDOL 2 versions through 2.12 **Description** An issue was discovered in the encryption mechanism used by UCI IDOL 2. Data sent between the client and server is encrypted, but the key is derived from a static string "(c)2007 UCI Software GmbH B.Boll". This key is hardcoded, allowing an attacker with access to messages to decrypt and encrypt them, thus enabling passive and active man-in-the-middle attacks. **Recommendations** For versions through 2.12, consider disabling the encryption mechanism that uses the static key until a patch is available. Restrict access to sensitive data and minimize the risk of exploitation by implementing additional security measures, such as monitoring network traffic for suspicious activity. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UCI IDOL 2 versions through 2.12 **Description** An issue was discovered in UCI IDOL 2 due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer. This issue makes UCI IDOL 2 vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. There is an access violation and EIP overwrite after five logins. **Recommendations** For UCI IDOL 2 versions through 2.12, consider disabling the login functionality until a patch is available to prevent potential Denial-of-Service (DoS) attacks and remote code execution. Restrict access to the system to minimize the risk of exploitation. Avoid using the system for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UCI IDOL 2 versions through 2.12 **Description** The issue is caused by improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer. This makes UCI IDOL 2 vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. A certain XmlMessage document can cause 100% CPU consumption. **Recommendations** For versions through 2.12, consider disabling the processing of XmlMessage documents until a patch is available to prevent 100% CPU consumption and potential Denial-of-Service (DoS) attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UCI IDOL 2 versions through 2.12 **Description** An issue was discovered in UCI IDOL 2, where data is transferred over a raw socket without any authentication mechanism. Thus, communication endpoints are not verifiable. **Recommendations** For versions through 2.12, consider disabling the use of raw sockets until a patch is available. Restrict access to the communication endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eaton easySoft (affected versions not specified) **Description** The Eaton easySoft software has a password protection functionality to secure project files from unauthorized access. However, the password was being stored insecurely, allowing skilled adversaries to retrieve it. This software is used to program easy controllers and displays for configuring, programming, and defining parameters for all intelligent relays. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eaton easyE4 PLC (affected versions not specified) **Description** The Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. However, it was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to an SD card, specifically in files with the *.PRG file ending. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Omikron MultiCash Desktop version 4.00.008.SP5 **Description** The issue arises from a client-side authentication mechanism. When a user logs in, the password validity is checked locally. All database backend communication uses the same technical account. An attacker can exploit this by attaching a debugger to the process or creating a patch that manipulates the login function to always return a success value, allowing login with any account, including the administrative account. **Recommendations** For Omikron MultiCash Desktop version 4.00.008.SP5, consider disabling the login function until a patch is available to prevent exploitation. Restrict access to the administrative account to minimize risk. Avoid using the application until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LOGO! 8 BM (incl. SIPLUS variants) versions prior to V8.3 **Description** A security issue has been identified where project data stored on the device can be decrypted due to a hardcoded encryption key. This data is accessible via port 10005/tcp. An unauthenticated attacker with network access to this port can exploit the issue without requiring any user interaction, impacting the confidentiality of the device. At the time of reporting, there were no known public exploits of this issue. **Recommendations** For versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10005/tcp to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LOGO! 8 BM (incl. SIPLUS variants) versions prior to V8.3 **Description** A security issue has been identified that allows attackers with access to port 10005/tcp to reconfigure devices and obtain project files. This can be exploited by an unauthenticated attacker with network access to the mentioned port, without requiring any user interaction. The issue affects the confidentiality, integrity, and availability of the device. At the time of reporting, there were no known public exploitations of this issue. The exploitation is related to errors in access control. **Recommendations** For versions prior to V8.3, as a temporary workaround, consider restricting access to port 10005/tcp to minimize the risk of exploitation. Additionally, follow the system manual's recommendation to protect access to this port. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LOGO! 8 BM versions prior to V8.3 **Description** The issue is related to the storage of unencrypted passwords in the project data. An attacker with network access to port 10005/tcp could exploit this to obtain device passwords. No user interaction is required for exploitation, and it affects the confidentiality of the device. At the time of reporting, there were no known public exploits. **Recommendations** For versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10005/tcp to minimize the risk of exploitation.