Sebastian Hamann

Name of the Vulnerable Software and Affected Versions: Bender GmbH & Co. KG charge controllers (affected versions not specified) Description: An authenticated, low-privileged attacker can obtain credentials stored on the charge controller, including the manufacturer password. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Bender Charge Controller product families (including CC612, CC613, ICC13xx, ICC15xx, ICC16xx) Description: The web interface uses HTTP instead of HTTPS due to an insecure default configuration. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Swissphone DiCal-RED 4009 devices (affected versions not specified) **Description** The issue allows an unauthenticated attacker to use a port-2101 TCP connection to gain access to operation messages received by the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Swissphone DiCal-RED 4009 devices (affected versions not specified) **Description** An issue was discovered on Swissphone DiCal-RED 4009 devices, where an attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cracking methods, because unsalted MD5 is used. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Swissphone DiCal-RED 4009 (affected versions not specified) **Description** The issue allows an authenticated attacker to gain access to arbitrary files on the device's file system through the `cgi-bin/fdmcgiwebv2.cgi` endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Swissphone DiCal-RED 4009 version not specified **Description** The issue allows a remote attacker to gain read access to almost the whole file system via anonymous FTP. This could potentially expose sensitive data. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For Swissphone DiCal-RED 4009, consider applying restrictive firewalling immediately to mitigate the risk of exploitation. As a temporary workaround, restrict access to the FTP service to minimize the risk of sensitive data exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Swissphone DiCal-RED 4009 devices (affected versions not specified) **Description** The issue allows an unauthenticated attacker to gain access to device logs through the `cgi-bin/fdmcgiwebv2.cgi` endpoint on Swissphone DiCal-RED 4009 devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Swissphone DiCal-RED 4009 devices (affected versions not specified) **Description** The issue allows a remote attacker to gain a root shell via TELNET without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Swissphone DiCal-RED 4009 (affected versions not specified) **Description** The issue allows a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softwarebuero Zauner ARC version 4.2.0.4 **Description** An issue was discovered that involves improper handling of case sensitivity. This issue makes password guessing easier. **Recommendations** For Softwarebuero Zauner ARC version 4.2.0.4, consider implementing additional security measures to mitigate the risk of password guessing, such as account lockout policies or two-factor authentication. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Softwarebuero Zauner ARC version 4.2.0.4 **Description** The issue involves cleartext transmission of sensitive information. This means that sensitive data is being sent without proper encryption, potentially exposing it to unauthorized access. **Recommendations** For Softwarebuero Zauner ARC version 4.2.0.4, consider restricting access to sensitive information until a fix is available. As a temporary workaround, avoid transmitting sensitive data using the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softwarebuero Zauner ARC version 4.2.0.4 **Description** An issue was discovered where passwords are stored in a recoverable format. **Recommendations** For Softwarebuero Zauner ARC version 4.2.0.4, consider updating the password storage mechanism to an unrecoverable format, such as hashing and salting, to prevent unauthorized access to passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Softwarebuero Zauner ARC version 4.2.0.4 **Description** An issue in the application allows attackers to escalate privileges, as permission checks are performed client-side rather than server-side. **Recommendations** For Softwarebuero Zauner ARC version 4.2.0.4, consider implementing server-side permission checks to prevent privilege escalation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FANUC Robotics Virtual Robot Controller version 8.23 **Description** The issue is related to a buffer overflow in the web server of the FANUC Robotics Virtual Robot Controller, which can be exploited by sending a forged HTTP request. This could allow an attacker to execute arbitrary code. **Recommendations** For version 8.23, consider restricting access to the web server until a patch is available. As a temporary workaround, avoid using the web server for administrative tasks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.