| CVE ID | CVSS Score | Severity | Description |
|---|---|---|---|
| CVE-2024-1182 | 7.0 | high |
When the affected products are installed with the Pager agent in the multi-agent notification feature, an arbitrary code execution vulnerability due to uncontrolled search path element exists in the feature. This vulnerability allows a local attacker to execute an arbitrary code by storing a specially crafted DLL in a specific folder.
|
| CVE-2024-1574 | 6.7 | medium |
An arbitrary code execution vulnerability due to use of externally-controlled input to select classes or code ('unsafe reflection') exists in the licensing feature of the affected products. This vulnerability allows a local attacker to execute an arbitrary code with administrative privileges by tampering with a specific file that is not protected by the system.
|
| CVE-2023-2650 | 3.7 | low |
When the BACnet Secure Connect feature is enabled in the affected products, a temporary denial-of-service vulnerability due to allocation of resources without limits or throttling exists in the OpenSSL library integrated into the products, during data validation. This vulnerability allows a remote attacker to cause a denial-of-service condition on the affected products by sending a certificate that contains a specially crafted ANS 1 OBJECT IDENTIFIER.
|
| CVE-2023-4807 | 5.9 | medium |
When running on X86_64 CPUs supporting AVX512-IFMA instructions and the BACnet Secure Connect feature is enabled in the affected products, a denial-of-service vulnerability due to improper verification of cryptographic signature exists in the Message Authentication Code (MAC) implementation in OpenSSL library integrated into the products. This vulnerability allows a remote attacker to cause a denial-of-service condition on the affected products by sending messages that contain specially crafted Message Authentication Code (MAC).
|
| CVE-2024-1573 | 5.9 | medium |
An authentication bypass vulnerability due to missing authentication for critical function exists in the mobile monitoring feature of the affected products when all of the following conditions are met: * Active Directory is used in the security setting. * "Automatic log in" option is enabled in the security setting. * The IcoAnyGlass IIS Application Pool is running under an Active Directory Domain Account. * The IcoAnyGlass IIS Application Pool account is included in GENESIS64, ICONCIS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, and MC Works64 Security and has permission to log in. This vulnerability allows a remote unauthenticated attacker to bypass proper authentication and log in to the system.
|
| Vendor | Product | Asset Type | Purdue Level | Firmware |
|---|---|---|---|---|
| Mitsubishi Electric | Unknown | historian |
L3
|
10.97.2 |
| Mitsubishi Electric Iconics Digital Solutions | Unknown | scada_server |
L2
|
10.97.2 |
| Mitsubishi Electric | Unknown | scada_server |
L2
|
10.97.2 |
| Mitsubishi Electric Iconics Digital Solutions | Unknown | historian |
L3
|
10.97.2 |
| Mitsubishi Electric | Unknown | hmi |
L2
|
10.97.2 |
| Mitsubishi Electric Iconics Digital Solutions | Unknown | hmi |
L2
|
10.97.2 |
| Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric | Unknown | hmi |
L2
|
10.97.2 |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | plc |
L1
|
-- |
| Siemens | Unknown | plc |
L1
|
-- |
| Siemens | Unknown | plc |
L1
|
-- |
| Siemens | Unknown | plc |
L1
|
-- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Siemens | Unknown | network_device | -- | -- |
| Mitsubishi Electric Iconics Digital Solutions, Mitsubishi Electric | Unknown | hmi |
L2
|
-- |