CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-30232
https://notcve.org/view.php?id=CVE-2022-30232
A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a request on the same network or has configuration access to an ION device on the network. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior) Una CWE-20: Se presenta una vulnerabilidad de Comprobación de Entrada Inapropiada que podría causar una potencial ejecución de código remota cuando un atacante es capaz de interceptar y modificar una petición en la misma red o presenta acceso de configuración a un dispositivo ION en la red. Productos afectados: Wiser Smart, EER21000 y EER21001 (versiones V4.5 y anteriores) • https://www.se.com/ww/en/download/document/SEVD-2022-130-01 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 0CVE-2022-26507
https://notcve.org/view.php?id=CVE-2022-26507
A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This is not the same as any of: CVE-2021-21810, CVE-2021-21811, CVE-2021-21812, CVE-2021-21815, CVE-2021-21825, CVE-2021-21826, CVE-2021-21828, CVE-2021-21829, or CVE-2021-21830. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Se presenta un desbordamiento de búfer en la región heap de la memoria en XML Decompression DecodeTreeBlock en AT&T Labs Xmill versión 0.7. Un archivo de entrada diseñado puede conllevar a una ejecución de código remota. • https://Claroty.com https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-02 • CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 26EXPL: 0CVE-2021-30066
https://notcve.org/view.php?id=CVE-2021-30066
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification (for a USB stick) can be bypassed. NOTE: this issue exists because of an incomplete fix of CVE-2017-11400. En Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 versiones anteriores a 03.23, TCSEFEA23F3F20/21, y Belden Tofino Xenon Security Appliance, puede cargarse una imagen de firmware arbitraria porque puede omitirse la verificación de la firma del firmware (para una memoria USB). NOTA: este problema se presenta debido a una corrección incompleta de CVE-2017-11400 • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05 https://www.belden.com/support/security-assurance • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0CVE-2021-30065
https://notcve.org/view.php?id=CVE-2021-30065
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401. En Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 versiones hasta 03.23, TCSEFEA23F3F20/21 y Belden Tofino Xenon Security Appliance, los paquetes ModBus diseñados pueden omitir el ModBus enforcer. NOTA: este problema se presenta debido a una corrección incompleta de CVE-2017-11401 • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05 https://www.belden.com/support/security-assurance •
CVSS: 9.8EPSS: 0%CPEs: 26EXPL: 0CVE-2021-30064
https://notcve.org/view.php?id=CVE-2021-30064
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials (if the device is in the uncommissioned state). En Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 versiones hasta 03.23, TCSEFEA23F3F20/21 y Belden Tofino Xenon Security Appliance, un inicio de sesión SSH puede tener éxito con credenciales embebidas predeterminadas (si el dispositivo está en el estado no comisionado) • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-05 https://www.belden.com/support/security-assurance • CWE-798: Use of Hard-coded Credentials •