Marco Balduzzi

**Name of the Vulnerable Software and Affected Versions** HEIDENHAIN Controller TNC 640 version 340590 07 SP5 **Description** The issue is related to improper authentication, which may allow an attacker to deny service to the production line, steal sensitive data from the production line, and alter any products created by the production line. **Recommendations** For version 340590 07 SP5, consider temporarily restricting access to the system until a patch or fix is available to prevent potential exploitation of the improper authentication issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Haas Controller version 100.20.000.1110 **Description** The issue concerns the transmission of communication traffic involving the "Ethernet Q Commands" service in cleartext. This allows an attacker to obtain sensitive information being passed to and from the controller. **Recommendations** For Haas Controller version 100.20.000.1110, consider implementing encryption for the "Ethernet Q Commands" service to protect sensitive information. As a temporary workaround, restrict access to the "Ethernet Q Commands" service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Haas Controller version 100.20.000.1110 **Description** The issue is related to insufficient granularity of access control when using the "Ethernet Q Commands" service. This allows any user to write macros into registers outside of the authorized accessible range, potentially enabling access to privileged resources or resources out of context. **Recommendations** For Haas Controller version 100.20.000.1110, consider restricting access to the "Ethernet Q Commands" service to minimize the risk of exploitation. As a temporary workaround, limit the ability of users to write macros into registers outside of their authorized accessible range until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Haas Controller version 100.20.000.1110 **Description** The issue concerns the "Ethernet Q Commands" service in the Haas Controller, where authentication is currently unsupported. This allows any user on the same network segment as the controller, including those connected remotely, to access the service and write unauthorized macros to the device. **Recommendations** For Haas Controller version 100.20.000.1110, consider disabling the "Ethernet Q Commands" service until a patch is available to prevent unauthorized access and macro writing. Restrict access to the network segment where the controller is located to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Crimson 3.1 (Build versions prior to 3119.001) Description: An attacker could send a specially crafted message to the software that could leak arbitrary memory locations. Recommendations: For Crimson 3.1 (Build versions prior to 3119.001), update to a version 3119.001 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: JUUKO K-800 versions prior to numbers ending ...9A Description: The issue allows attackers to perform a replay attack and command forgery, potentially enabling them to replay commands, control the device, view commands, or cause the device to stop running. Recommendations: For JUUKO K-800 versions prior to numbers ending ...9A, update the firmware to a version with numbers ending ...9A or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: JUUKO K-808 versions prior to numbers ending ...9A, ...9B, ...9C, etc. Description: The issue allows remote attackers to execute commands on vulnerable installations of the equipment. No authentication is required to exploit this issue. The flaw lies in the handling of data between the transmitter and receiver. By using a fixed control code used for encoding data transmitted over radio frequency, an attacker can spoof unauthorized commands to the receiver. This can be used to send commands to physical equipment controlled by the device. Recommendations: For versions prior to numbers ending ...9A, ...9B, ...9C, etc., consider restricting access to the device until a patch is available. As a temporary workaround, avoid using the fixed control code for encoding data transmitted over radio frequency until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Moxa MGate 5105-MB-EIP version 4.1 Description: The issue is related to the DestIP parameter in the Moxa MGate 5105-MB-EIP firmware, which lacks proper validation of user-supplied strings before executing system calls. This allows remote attackers to execute arbitrary code, potentially leading to privilege escalation. The exploitation requires authentication. The vulnerability is exploited through the `DestIP` parameter within the `MainPing.asp` endpoint. Recommendations: For version 4.1, consider restricting access to the `MainPing.asp` endpoint and the `DestIP` parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hetronic Nova-M versions prior to r161 **Description** The issue allows for unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state due to the use of fixed codes that can be reproducible by sniffing and re-transmission. **Recommendations** For versions prior to r161, update to version r161 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication or encryption mechanisms to prevent sniffing and re-transmission of commands. Restrict access to the system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SAGA1-L8B versions prior to A0.10 **Description** The issue allows an attacker to force-pair the device without human interaction, potentially leading to remote code execution. **Recommendations** For versions prior to A0.10, update the firmware to version A0.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Telecrane F25 Series Radio Controls versions prior to 00.0A **Description** The issue concerns the use of fixed codes in the Telecrane F25 Series Radio Controls, which can be reproduced by sniffing and re-transmission. This allows for unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state. **Recommendations** For versions prior to 00.0A, update to version 00.0A or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAGA1-L8B versions prior to A0.10 **Description** The issue allows an attacker with physical access to the product to potentially reprogram it. **Recommendations** For versions prior to A0.10, update the firmware to version A0.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAGA1-L8B versions prior to A0.10 **Description** The issue allows for a replay attack and command forgery. **Recommendations** For versions prior to A0.10, update the firmware to version A0.10 or later to resolve the issue.