# Recent vulnerabilities from ifm electronic GmbH ## [vde-2026-005](https://vulnerability.circl.lu/vuln/vde-2026-005) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "notes": [ { "category": "summary", "text": "The Firmware installed on the CR3171 is impacted by various CODESYS vulnerabilities.", "title": "Summary" }, { "category": "legal_disclaimer", "text": "THIS DOCUMENT IS PROVIDED ON AN \\\\\\\"AS IS\\\\\\\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. IFM RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of ifm products.", "title": "Disclaimer" }, { "category": "general", "text": "When using automation components, make sure that no unauthorized access can take place. In addition, measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "title": "General Recommendation" }, { "category": "description", "text": "Update to the Firmware Version 3.3", "title": "Remediation" }, { "category": "description", "text": "CVE-2025-41659 : Unauthorized access to PKI files allows attackers to extract sensitive cryptographic keys and manipulate trusted certificates. This compromises system integrity, confidentiality and partially affects availability.\n\nCVE-2025-41658 : The affected products do not explicitly restrict read permissions for other local operating system users, potentially allowing unauthorized access to sensitive runtime files.\n\nCVE-2025-41691 : Exploitation of this vulnerability can lead to a denial-of-service (DoS) condition on affected PLCs, disrupting industrial control systems.", "title": "Impact" }, { "category": "description", "text": "CVE-2025-41659 : The vulnerability affects devices running firmware versions prior to 3.3. Due to the nature of the issue, no configuration changes, operational workarounds, or compensating controls are available that would sufficiently reduce the associated risk. Therefore, it is essential to update the affected device to firmware version 3.3.\nOperating the device on earlier firmware versions results in continued exposure to the vulnerability. Once firmware version 3.3 is installed, the vulnerability is considered fully resolved.\n\nCVE-2025-41658 : If the CODESYS Control runtime system is operated on an operating system with multi-user support, other users may potentially gain access to runtime-related files. Thus, it is essential to configure the storage locations for CODESYS Control runtime files in accordance with the operating system's security best practices. These locations should, by default, restrict access to unauthorized users. If the operating system does not support such access control mechanisms or if implementing them is not feasible, an alternative approach is to explicitly revoke read and write permissions for all non-administrative users on the directories used by the CODESYS Control runtime system.\n\nThe following directories must be secured:\n* The directory containing configuration files\n* The directory containing binary files\n* The working directory used by the runtime system\n\nNote: Protecting individual files is not sufficient. The entire directories must be secured to ensure that any files created in the future are also protected.\n\nAs possible countermeasures, it can be examined whether avoiding the use of the CODESYS environment in one's own application design is feasible.\n\nAlternatively, where applicable, all non-administrative user accounts can be removed from the system, and their re-creation should be prevented. Additionally, it is recommended to disable remote access methods that allow file access (e.g., SSH) wherever possible, in order to reduce the overall attack surface.\n\nBest practice recommendations for Linux and QNX Systems:\n* Create a dedicated privileged group for accessing the above-mentioned directories, and add the user account under which the runtime process is executed to this group.\n* Set the file system permissions for these directories to deny access to \"other\" users (e.g., chmod o-rx).\n* If access for additional users is required, they can be added to the privileged group as needed.\n\nCVE-2025-41691 : The vulnerability can be mitigated by restricting the allowed login authentication type \"CmpUserMgr/UserLogin_AuthenticationType\" to \"ONLY_ASYMMETRIC\". This can be configured either via the Device Security Settings dialog in the CODESYS Development System or directly in the configuration file of the CODESYS Control runtime system (CODESYSControl.cfg) by adding the following setting:\n\n[CmpUserMgr]\nSECURITY.UserLogin_AuthenticationType=ONLY_ASYMMETRIC\n\nWith this configuration in place, both potential attackers and legacy CODESYS protocol clients (prior to version 3.5.16.0) will be blocked from logging in, thereby preventing execution of the vulnerable code path.\n\nAs possible countermeasures, it can be examined whether avoiding the use of the CODESYS environment in one's own application design is feasible.", "title": "Mitigation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@ifm.com", "name": "ifm electronic GmbH", "namespace": "https://www.ifm.com" }, "references": [ { "category": "external", "summary": "ifm advisory overview at CERT@VDE", "url": "https://certvde.com/de/advisories/vendor/ifm/" }, { "category": "self", "summary": "VDE-2026-005: ifm: Multiple Vulnerabilities in CR3171 - CSAF", "url": "https://ifm.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-005.json" }, { "category": "self", "summary": "VDE-2026-005: ifm: Multiple Vulnerabilities in CR3171 - HTML", "url": "https://certvde.com/en/advisories/VDE-2026-005" } ], "title": "ifm: Multiple Vulnerabilities in CR3171", "tracking": { "aliases": [ "VDE-2026-005" ], "current_release_date": "2026-05-06T08:00:00.000Z", "generator": { "date": "2026-05-06T07:53:36.480Z", "engine": { "name": "Secvisogram", "version": "2.5.44" } }, "id": "VDE-2026-005", "initial_release_date": "2026-05-06T08:00:00.000Z", "revision_history": [ { "date": "2026-05-06T08:00:00.000Z", "number": "1.0.0", "summary": "initial release" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "3.1", "product": { "name": "Firmware 3.1", "product_id": "CSAFPID-21001", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:cr3171_firmware:3.1:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.2", "product": { "name": "Firmware 3.2", "product_id": "CSAFPID-22001", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:cr3171_firmware:3.2:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "3.3", "product": { "name": "ifm electronic gmbh Firmware 3.3", "product_id": "CSAFPID-22002", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:cr3171_firmware:3.3:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Firmware" }, { "branches": [ { "category": "product_name", "name": "CR3171", "product": { "name": "CR3171", "product_id": "CSAFPID-11001", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:cr3171:*:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Hardware" } ], "category": "vendor", "name": "ifm electronic gmbh" } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware 3.1 installed on CR3171", "product_id": "CSAFPID-0003", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:cr3171_firmware:3.1:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 3.2 installed on CR3171", "product_id": "CSAFPID-0004", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:cr3171_firmware:3.2:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "ifm electronic gmbh Firmware 3.3 installed on CR3171", "product_id": "CSAFPID-0002", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:cr3171_firmware:3.3:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11001" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-41691", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.", "title": "CVE description" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0003", "CSAFPID-0004" ] }, "remediations": [ { "category": "vendor_fix", "details": "will be fixed in Firmware Version 3.3", "product_ids": [ "CSAFPID-0003", "CSAFPID-0004" ], "url": "https://www.ifm.com/de/en/product/CR3171#documents" }, { "category": "mitigation", "details": "deactivate CodeSys enviroment on device", "product_ids": [ "CSAFPID-0003", "CSAFPID-0004" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0003", "CSAFPID-0004" ] } ], "title": "CODESYS Control DoS via Unauthenticated NULL Pointer Dereference" }, { "cve": "CVE-2025-41659", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "description", "text": "A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.", "title": "CVE description" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0003", "CSAFPID-0004" ] }, "remediations": [ { "category": "vendor_fix", "details": "will be fixed in Firmware Version 3.3", "product_ids": [ "CSAFPID-0003", "CSAFPID-0004" ], "url": "https://www.ifm.com/de/en/product/CR3171#documents" }, { "category": "mitigation", "details": "deactivate CodeSys enviroment on device", "product_ids": [ "CSAFPID-0003", "CSAFPID-0004" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1" }, "products": [ "CSAFPID-0003", "CSAFPID-0004" ] } ], "title": "CODESYS Control PKI Exposure Enables Remote Certificate Access" }, { "cve": "CVE-2025-41658", "cwe": { "id": "CWE-276", "name": "Incorrect Default Permissions" }, "notes": [ { "category": "description", "text": "CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.", "title": "CVE description" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0003", "CSAFPID-0004" ] }, "remediations": [ { "category": "vendor_fix", "details": "will be fixed in Firmware Version 3.3", "product_ids": [ "CSAFPID-0003", "CSAFPID-0004" ], "url": "https://www.ifm.com/de/en/product/CR3171#documents" }, { "category": "mitigation", "details": "deactivate CodeSys enviroment on device", "product_ids": [ "CSAFPID-0003", "CSAFPID-0004" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0003", "CSAFPID-0004" ] } ], "title": "CODESYS Toolkit Exposes Sensitive Files via Default Permissions" } ] } ``` ## [vde-2024-061](https://vulnerability.circl.lu/vuln/vde-2024-061) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "names": [ "Dmytro Kryhin" ], "organization": "National Technical University of Ukraine \"Igor Sikorsky Kyiv Polytechnic Institute\"", "summary": "reporting", "urls": [ "https://kpi.ua/en" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "High" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "A vulnerability has been disclosed in PLC ifm AC4xxS that allows an attacker to trigger the safety state with the help of a specially crafted html request. This leads to a loss of availability.", "title": "Summary" }, { "category": "description", "text": "An unauthorized attacker can exploit this vulnerability to issue malicious commands to the PLC, potentially disrupting or damaging the production line. ", "title": "Impact" }, { "category": "description", "text": "When using automation components, make sure that no unauthorized access can take place. In addition, measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.\n\nPLC with firmware V6.1.8 http interface can be disabled.", "title": "Mitigation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@ifm.com", "name": "ifm electronic GmbH", "namespace": "https://www.ifm.com" }, "references": [ { "category": "external", "summary": "CERT@VDE Security Advisories for ifm electronic GmbH", "url": "https://certvde.com/en/advisories/vendor/ifm" }, { "category": "self", "summary": "VDE-2024-061: ifm: Improper Access Control vulnerability - HTML", "url": "https://certvde.com/en/advisories/VDE-2024-061" }, { "category": "self", "summary": "VDE-2024-061: ifm: Improper Access Control vulnerability - CSAF", "url": "https://ifm.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2024-061.json" }, { "category": "external", "summary": "ifm electronic GmbH PSIRT", "url": "https://www.ifm.com/de/en/shared/service/technischer-support/product-security-overview" } ], "title": "ifm: Improper Access Control vulnerability", "tracking": { "aliases": [ "VDE-2024-061", "ifm-23082024" ], "current_release_date": "2026-02-18T08:00:00.000Z", "generator": { "date": "2026-02-18T07:57:21.164Z", "engine": { "name": "Secvisogram", "version": "2.5.43" } }, "id": "VDE-2024-061", "initial_release_date": "2025-06-30T10:00:00.000Z", "revision_history": [ { "date": "2025-06-30T10:00:00.000Z", "legacy_version": "1", "number": "1.0.0", "summary": "Initial release." }, { "date": "2026-02-16T15:00:00.000Z", "number": "2.0.0", "summary": "Updated content and product names." }, { "date": "2026-02-18T08:00:00.000Z", "number": "2.0.1", "summary": "Fixed Typo." } ], "status": "final", "version": "2.0.1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AC402s", "product": { "name": "ifm Smart PLC AC402s", "product_id": "CSAFPID-0010", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac402s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "AC422s", "product": { "name": "ifm Smart PLC AC422s", "product_id": "CSAFPID-0011", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac422s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "AC424s", "product": { "name": "ifm Smart PLC AC424s", "product_id": "CSAFPID-0012", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac424s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "AC432s", "product": { "name": "ifm Smart PLC AC432s", "product_id": "CSAFPID-0013", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac432s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "AC434s", "product": { "name": "ifm Smart PLC AC434s", "product_id": "CSAFPID-0014", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac434s:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Smart PLC" }, { "branches": [ { "category": "product_version_range", "name": "vers:generic/4.04<4.3.17", "product": { "name": "Firmware 4.04<4.3.17", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "6.1.8", "product": { "name": "Firmware 6.1.8", "product_id": "CSAFPID-0004", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:ac4xxS:6.1.8:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Firmware" } ], "category": "vendor", "name": "ifm" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0022", "CSAFPID-0023", "CSAFPID-0024" ], "summary": "Affected products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware 4.04<4.3.17 installed on ifm Smart PLC AC402s", "product_id": "CSAFPID-0015" }, "product_reference": "CSAFPID-0003", "relates_to_product_reference": "CSAFPID-0010" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 4.04<4.3.17 installed on ifm Smart PLC AC422s", "product_id": "CSAFPID-0016" }, "product_reference": "CSAFPID-0003", "relates_to_product_reference": "CSAFPID-0011" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 4.04<4.3.17 installed on ifm Smart PLC AC424s", "product_id": "CSAFPID-0017" }, "product_reference": "CSAFPID-0003", "relates_to_product_reference": "CSAFPID-0012" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 4.04<4.3.17 installed on ifm Smart PLC AC432s", "product_id": "CSAFPID-0018" }, "product_reference": "CSAFPID-0003", "relates_to_product_reference": "CSAFPID-0013" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 4.04<4.3.17 installed on ifm Smart PLC AC434s", "product_id": "CSAFPID-0019" }, "product_reference": "CSAFPID-0003", "relates_to_product_reference": "CSAFPID-0014" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on ifm Smart PLC AC402s", "product_id": "CSAFPID-0020" }, "product_reference": "CSAFPID-0004", "relates_to_product_reference": "CSAFPID-0010" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on ifm Smart PLC AC422s", "product_id": "CSAFPID-0021" }, "product_reference": "CSAFPID-0004", "relates_to_product_reference": "CSAFPID-0011" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on ifm Smart PLC AC424s", "product_id": "CSAFPID-0022" }, "product_reference": "CSAFPID-0004", "relates_to_product_reference": "CSAFPID-0012" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on ifm Smart PLC AC432s", "product_id": "CSAFPID-0023" }, "product_reference": "CSAFPID-0004", "relates_to_product_reference": "CSAFPID-0013" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on ifm Smart PLC AC434s", "product_id": "CSAFPID-0024" }, "product_reference": "CSAFPID-0004", "relates_to_product_reference": "CSAFPID-0014" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-8419", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "audience": "all", "category": "description", "text": "The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication.", "title": "CVE Description" } ], "product_status": { "known_affected": [ "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0022", "CSAFPID-0023", "CSAFPID-0024" ] }, "remediations": [ { "category": "mitigation", "details": "When using automation components, make sure that no unauthorized access can take place. In addition, measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.\n\nPLC with firmware V6.1.8 http interface can be disabled.", "group_ids": [ "CSAFGID-0001" ], "product_ids": [ "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0022", "CSAFPID-0023", "CSAFPID-0024" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0022", "CSAFPID-0023", "CSAFPID-0024" ] } ], "title": "Improper Access Control vulnerability in AC4xxS devices" } ] } ``` ## [vde-2024-028](https://vulnerability.circl.lu/vuln/vde-2024-028) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "moneo \\\"Forgot Password\\\" function has a vulnerability which allows gaining privileged access.", "title": "Summary" }, { "category": "description", "text": "In a moneo appliance with no mailserver configured, an unauthorized attacker can reset a password to the new user default value.", "title": "Impact" }, { "category": "description", "text": "The correct configuration of a mail server prevents the exploitation of the vulnerability.", "title": "Mitigation" }, { "category": "description", "text": "Update to moneo version 1.13.5 or later.", "title": "Remediation" }, { "category": "general", "text": "When using automation components, make sure that no unauthorized access can take place. In addition, measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "title": "General Recommendation" }, { "category": "legal_disclaimer", "text": "THIS DOCUMENT IS PROVIDED ON AN \\\"AS IS\\\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. IFM RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of ifm products.", "title": "Disclaimer" } ], "publisher": { "category": "vendor", "contact_details": "psirt@ifm.com", "name": "ifm electronic GmbH", "namespace": "https://www.ifm.com" }, "references": [ { "category": "self", "summary": "VDE-2024-028: ifm moneo password reset can be exploited - HTML", "url": "https://certvde.com/en/advisories/VDE-2024-028" }, { "category": "external", "summary": "CERT@VDE Security Advisories for ifm products", "url": "https://certvde.com/en/advisories/vendor/ifm/" }, { "category": "self", "summary": "VDE-2024-028: ifm moneo password reset can be exploited - CSAF", "url": "https://ifm.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-028.json" } ], "title": "ifm moneo password reset can be exploited", "tracking": { "aliases": [ "VDE-2024-028" ], "current_release_date": "2026-01-15T11:00:00.000Z", "generator": { "date": "2026-01-30T08:32:05.707Z", "engine": { "name": "Secvisogram", "version": "2.5.42" } }, "id": "VDE-2024-028", "initial_release_date": "2024-05-06T10:00:00.000Z", "revision_history": [ { "date": "2024-05-06T10:00:00.000Z", "number": "1.0.0", "summary": "initial revision" }, { "date": "2024-05-24T10:00:00.000Z", "number": "2.0.0", "summary": "final draft" }, { "date": "2024-05-27T10:00:00.000Z", "number": "3.0.0", "summary": "Update" }, { "date": "2024-06-03T09:00:00.000Z", "number": "4.0.0", "summary": "Update after review" }, { "date": "2024-10-30T11:00:00.000Z", "number": "5.0.0", "summary": "no security relevant changes\nchanged URLs from cert-vde.com to certvde.com\nrevamped product tree" }, { "date": "2024-11-06T11:27:01.000Z", "number": "6.0.0", "summary": "Fix: added self-reference" }, { "date": "2025-01-28T11:00:00.000Z", "number": "7.0.0", "summary": "Update: changed affected products group" }, { "date": "2025-02-03T11:00:00.000Z", "number": "8.0.0", "summary": "fix TLP to white" }, { "date": "2025-02-28T11:00:00.000Z", "number": "9.0.0", "summary": "fixed: \n * initial release date\n * spacing in version ranges\n * reference category" }, { "date": "2026-01-06T11:00:00.000Z", "number": "10.0.0", "summary": "changed Windows form product name to product family and fixed the version range, added CPEs" }, { "date": "2026-01-15T11:00:00.000Z", "number": "11.0.0", "summary": "add cpe product identifier to Hardware and Software" } ], "status": "final", "version": "11.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "QVA200", "product": { "name": "QVA200", "product_id": "CSAFPID-11001", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:qha200:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "QHA210", "product": { "name": "QHA210", "product_id": "CSAFPID-11002", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:qha210:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "QHA300", "product": { "name": "QHA300", "product_id": "CSAFPID-11003", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:qha300:*:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/<1.13.5", "product": { "name": "moneo <1.13.5", "product_id": "CSAFPID-51001" } }, { "category": "product_version", "name": "1.13.5", "product": { "name": "moneo 1.13.5", "product_id": "CSAFPID-52001", "product_identification_helper": { "cpe": "cpe:2.3:a:ifm_electronic:moneo:1.13.5:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "moneo" } ], "category": "product_family", "name": "Software" } ], "category": "vendor", "name": "ifm electronic GmbH" }, { "branches": [ { "branches": [ { "category": "product_family", "name": "Windows ", "product": { "name": "Microsoft Windows", "product_id": "CSAFPID-90001", "product_identification_helper": { "cpe": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "OS" } ], "category": "vendor", "name": "Microsoft " } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-3101", "CSAFPID-3102", "CSAFPID-3103", "CSAFPID-3104" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0003", "product_ids": [ "CSAFPID-3201", "CSAFPID-3202", "CSAFPID-3203", "CSAFPID-3204" ], "summary": "Fixed products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "moneo <1.13.5 installed on QVA200", "product_id": "CSAFPID-3101" }, "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "moneo <1.13.5 installed on QHA210", "product_id": "CSAFPID-3102" }, "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "moneo <1.13.5 installed on QHA300", "product_id": "CSAFPID-3103" }, "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "moneo 1.13.5 installed on QVA200", "product_id": "CSAFPID-3201" }, "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "moneo 1.13.5 installed on QHA210", "product_id": "CSAFPID-3202" }, "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "moneo <1.13.5 installed on Microsoft Windows", "product_id": "CSAFPID-3104" }, "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-90001" }, { "category": "installed_on", "full_product_name": { "name": "moneo 1.13.5 installed on Microsoft Windows", "product_id": "CSAFPID-3204" }, "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-90001" }, { "category": "installed_on", "full_product_name": { "name": "moneo 1.13.5 installed on QHA300", "product_id": "CSAFPID-3203" }, "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-11003" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-5404", "cwe": { "id": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password" }, "notes": [ { "category": "description", "text": "An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.", "title": "Description" } ], "product_status": { "fixed": [ "CSAFPID-3201", "CSAFPID-3202", "CSAFPID-3203", "CSAFPID-3204" ], "known_affected": [ "CSAFPID-3101", "CSAFPID-3102", "CSAFPID-3103", "CSAFPID-3104" ] }, "release_date": "2024-06-03T09:00:00.000Z", "remediations": [ { "category": "mitigation", "date": "2024-06-06T09:00:00.000Z", "details": "Update to moneo version 1.13.5 or later.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-3101", "CSAFPID-3102", "CSAFPID-3103", "CSAFPID-3104" ] } ], "title": "CVE-2024-5404" } ] } ``` ## [vde-2024-012](https://vulnerability.circl.lu/vuln/vde-2024-012) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "names": [ "Logan Carpenter" ], "organization": "Dragos", "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "In ifm Smart PLC firmware up to version 4.3.17 for Smart PLC controllers AC14xx and AC4xxS, an attacker can access the configuration by using the hardcoded credentials. The endpoint hosts a scripts capable of executing various commands.", "title": "Summary" }, { "category": "description", "text": "Please see the CVE description.", "title": "Impact" }, { "category": "description", "text": "When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "title": "Mitigation" }, { "category": "description", "text": "Update to Firmware Version 6.1.8 or later.", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@ifm.com", "name": "ifm electronic GmbH", "namespace": "https://www.ifm.com" }, "references": [ { "category": "self", "summary": "VDE-2024-012: ifm: Vulnerabilities in ifm AC14 firmware - HTML", "url": "https://certvde.com/en/advisories/VDE-2024-012/" }, { "category": "self", "summary": "VDE-2024-012: ifm: Vulnerabilities in ifm AC14 firmware - CSAF", "url": "https://ifm.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-012.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.ifm.com" }, { "category": "external", "summary": "CERT@VDE Security Advisories for ifm electronic GmbH", "url": "https://certvde.com/en/advisories/vendor/ifm/" } ], "title": "ifm: Vulnerabilities in ifm AC14 firmware", "tracking": { "aliases": [ "VDE-2024-012" ], "current_release_date": "2026-01-15T11:00:00.000Z", "generator": { "date": "2026-01-30T08:26:37.355Z", "engine": { "name": "Secvisogram", "version": "2.5.42" } }, "id": "VDE-2024-012", "initial_release_date": "2024-07-09T07:00:00.000Z", "revision_history": [ { "date": "2024-07-09T07:00:00.000Z", "number": "1.0.0", "summary": "Initial revision." }, { "date": "2025-08-27T10:00:00.000Z", "number": "1.1.0", "summary": "Update: CWE from CVE-2024-28751, Revision History" }, { "date": "2026-01-06T11:00:00.000Z", "number": "2.0.0", "summary": "Fixed Version range, Added Score to Vulnerability CVE-2024-28750, deleted \"firmware\" from the full product name of the hardware, changed Vulnerability title to CVE description" }, { "date": "2026-01-15T11:00:00.000Z", "number": "3.0.0", "summary": "Update Product information" } ], "status": "final", "version": "3.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Smart PLC AC1401", "product": { "name": "Smart PLC AC1401", "product_id": "CSAFPID-11001", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1401:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC402s ", "product": { "name": "Smart PLC AC402s ", "product_id": "CSAFPID-11002", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac402s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1402", "product": { "name": "Smart PLC AC1402", "product_id": "CSAFPID-32003", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1402:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1403", "product": { "name": "Smart PLC AC1403", "product_id": "CSAFPID-32004", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1403:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1404", "product": { "name": "Smart PLC AC1404", "product_id": "CSAFPID-32005", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1404:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1411", "product": { "name": "Smart PLC AC1411", "product_id": "CSAFPID-32006", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac14011:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1412", "product": { "name": "Smart PLC AC1412", "product_id": "CSAFPID-32007", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1412:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1421", "product": { "name": "Smart PLC AC1421", "product_id": "CSAFPID-32008", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1421:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1422", "product": { "name": "Smart PLC AC1421", "product_id": "CSAFPID-32009", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1422:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1423", "product": { "name": "Smart PLC AC1423", "product_id": "CSAFPID-32010", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1423:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1424", "product": { "name": "Smart PLC AC1424", "product_id": "CSAFPID-32011", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1424:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1433", "product": { "name": "Smart PLC AC1433", "product_id": "CSAFPID-32012", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1433:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC1434", "product": { "name": "Smart PLC AC1434", "product_id": "CSAFPID-32013", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac1434:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC422s ", "product": { "name": "Smart PLC AC422s ", "product_id": "CSAFPID-32014", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac422s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC424s ", "product": { "name": "Smart PLC AC424s ", "product_id": "CSAFPID-32015", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac424s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC432s ", "product": { "name": "Smart PLC AC432s ", "product_id": "CSAFPID-32016", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac432s:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "Smart PLC AC434s ", "product": { "name": "Smart PLC AC434s ", "product_id": "CSAFPID-32017", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:ac434s:*:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "category": "product_version_range", "name": "vers:semver/<=4.3.17", "product": { "name": "Firmware <=V4.3.17", "product_id": "CSAFPID-21001" } }, { "category": "product_version", "name": "6.1.8", "product": { "name": "Firmware 6.1.8", "product_id": "CSAFPID-22001", "product_identification_helper": { "cpe": "cpe:2.3:o:ifm_electronic:ac_firmware:6.1.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "ifm" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0023", "CSAFPID-0024", "CSAFPID-0025", "CSAFPID-0026", "CSAFPID-0027", "CSAFPID-0028", "CSAFPID-0029", "CSAFPID-0030", "CSAFPID-0031", "CSAFPID-0032", "CSAFPID-0033" ], "summary": "Fixed products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1401", "product_id": "CSAFPID-31001" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC402s ", "product_id": "CSAFPID-31002" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1401", "product_id": "CSAFPID-32001" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC402s ", "product_id": "CSAFPID-32002" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1412", "product_id": "CSAFPID-0001" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32007" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1402", "product_id": "CSAFPID-0004" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1403", "product_id": "CSAFPID-0005" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1404", "product_id": "CSAFPID-0006" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1411", "product_id": "CSAFPID-0007" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32006" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1412", "product_id": "CSAFPID-0008" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32007" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1423", "product_id": "CSAFPID-0009" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32010" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1424", "product_id": "CSAFPID-0010" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32011" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1433", "product_id": "CSAFPID-0011" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32012" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1434", "product_id": "CSAFPID-0012" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32013" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC422s ", "product_id": "CSAFPID-0013" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32014" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC424s ", "product_id": "CSAFPID-0014" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32015" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC434s ", "product_id": "CSAFPID-0015" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32017" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC432s ", "product_id": "CSAFPID-0016" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32016" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=V4.3.17 installed on Smart PLC AC1421", "product_id": "CSAFPID-0017" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-32008" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1402", "product_id": "CSAFPID-0018" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1403", "product_id": "CSAFPID-0019" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1404", "product_id": "CSAFPID-0020" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1411", "product_id": "CSAFPID-0021" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32006" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1411", "product_id": "CSAFPID-0023" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32006" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1421", "product_id": "CSAFPID-0024" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32008" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1421", "product_id": "CSAFPID-0025" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32009" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1423", "product_id": "CSAFPID-0026" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32010" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1424", "product_id": "CSAFPID-0027" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32011" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1433", "product_id": "CSAFPID-0028" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32012" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC1434", "product_id": "CSAFPID-0029" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32013" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC422s ", "product_id": "CSAFPID-0030" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32014" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC424s ", "product_id": "CSAFPID-0031" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32015" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC432s ", "product_id": "CSAFPID-0032" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32016" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 6.1.8 installed on Smart PLC AC434s ", "product_id": "CSAFPID-0033" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-32017" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-28751", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "description", "text": "An high privileged remote attacker can enable telnet access that accepts hardcoded credentials. \n", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0023", "CSAFPID-0024", "CSAFPID-0025", "CSAFPID-0026", "CSAFPID-0027", "CSAFPID-0028", "CSAFPID-0029", "CSAFPID-0030", "CSAFPID-0031", "CSAFPID-0032", "CSAFPID-0033" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] }, "remediations": [ { "category": "mitigation", "details": "When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Update to Firmware Version 6.1.8 or later.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.1, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "temporalScore": 9.1, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] } ], "title": "CVE-2024-28751" }, { "cve": "CVE-2024-28750", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "A remote attacker with high privileges may use a deleting file function to inject OS commands.\n", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0023", "CSAFPID-0024", "CSAFPID-0025", "CSAFPID-0026", "CSAFPID-0027", "CSAFPID-0028", "CSAFPID-0029", "CSAFPID-0030", "CSAFPID-0031", "CSAFPID-0032", "CSAFPID-0033" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] }, "remediations": [ { "category": "mitigation", "details": "When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Update to Firmware Version 6.1.8 or later.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] } ], "title": "CVE-2024-28750" }, { "cve": "CVE-2024-28749", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "A remote attacker with high privileges may use a writing file function to inject OS commands.\n", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0023", "CSAFPID-0024", "CSAFPID-0025", "CSAFPID-0026", "CSAFPID-0027", "CSAFPID-0028", "CSAFPID-0029", "CSAFPID-0030", "CSAFPID-0031", "CSAFPID-0032", "CSAFPID-0033" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] }, "remediations": [ { "category": "mitigation", "details": "When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Update to Firmware Version 6.1.8 or later.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] } ], "title": "CVE-2024-28749" }, { "cve": "CVE-2024-28748", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "A remote attacker with high privileges may use a reading file function to inject OS commands.\n", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0023", "CSAFPID-0024", "CSAFPID-0025", "CSAFPID-0026", "CSAFPID-0027", "CSAFPID-0028", "CSAFPID-0029", "CSAFPID-0030", "CSAFPID-0031", "CSAFPID-0032", "CSAFPID-0033" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] }, "remediations": [ { "category": "mitigation", "details": "When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Update to Firmware Version 6.1.8 or later.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] } ], "title": "CVE-2024-28748" }, { "cve": "CVE-2024-28747", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "notes": [ { "category": "description", "text": "An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.\n", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-0018", "CSAFPID-0019", "CSAFPID-0020", "CSAFPID-0021", "CSAFPID-0023", "CSAFPID-0024", "CSAFPID-0025", "CSAFPID-0026", "CSAFPID-0027", "CSAFPID-0028", "CSAFPID-0029", "CSAFPID-0030", "CSAFPID-0031", "CSAFPID-0032", "CSAFPID-0033" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] }, "remediations": [ { "category": "mitigation", "details": "When using automation components, make sure that no unauthorized access can take place. Addition measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Update to Firmware Version 6.1.8 or later.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-0001", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006", "CSAFPID-0007", "CSAFPID-0008", "CSAFPID-0009", "CSAFPID-0010", "CSAFPID-0011", "CSAFPID-0012", "CSAFPID-0013", "CSAFPID-0014", "CSAFPID-0015", "CSAFPID-0016", "CSAFPID-0017" ] } ], "title": "CVE-2024-28747" } ] } ``` ## [vde-2022-050](https://vulnerability.circl.lu/vuln/vde-2022-050) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Aimon Dawson", "summary": "reporting" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "An unauthenticated remote attacker could reset the administrator's password with information from the default, self-signed certificate.", "title": "Summary" }, { "category": "description", "text": "An unathenticated attacker can remotely reset the administrator password.", "title": "Impact" }, { "category": "description", "text": "The certificate is renewed by adjusting the hostname to an own customer-specific, so it does not contain the serial number.", "title": "Mitigation" }, { "category": "description", "text": "The password-reset mechanism will be updated in a future version.\nWhen using automation components, make sure that no unauthorized access can take place. In addition, measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@ifm.com", "name": "ifm electronic GmbH", "namespace": "https://www.ifm.com" }, "references": [ { "category": "self", "summary": "VDE-2022-050: IFM: weak password recovery vulnerability in moneo appliance - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-050/" }, { "category": "self", "summary": "VDE-2022-050: IFM: weak password recovery vulnerability in moneo appliance - CSAF", "url": "https://ifm.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-050.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.ifm.com" }, { "category": "external", "summary": "CERT@VDE Security Advisories for ifm electronic GmbH", "url": "https://certvde.com/en/advisories/vendor/ifm/" } ], "title": "IFM: weak password recovery vulnerability in moneo appliance", "tracking": { "aliases": [ "VDE-2022-050" ], "current_release_date": "2026-01-06T11:00:00.000Z", "generator": { "date": "2026-01-30T08:42:49.132Z", "engine": { "name": "Secvisogram", "version": "2.5.42" } }, "id": "VDE-2022-050", "initial_release_date": "2022-12-12T11:00:00.000Z", "revision_history": [ { "date": "2022-12-12T11:00:00.000Z", "number": "1.0.0", "summary": "Initial revision." }, { "date": "2026-01-06T11:00:00.000Z", "number": "2.0.0", "summary": "fixed version range, added Hardware with relationship, changed vulnerability title to CVE description" } ], "status": "final", "version": "2.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/<=1.9.3", "product": { "name": "moneo appliance <=1.9.3", "product_id": "CSAFPID-51001" } } ], "category": "product_name", "name": "moneo appliance" } ], "category": "product_family", "name": "Software" }, { "branches": [ { "category": "product_name", "name": "QHA210", "product": { "name": "QHA210", "product_id": "CSAFPID-11001", "product_identification_helper": { "cpe": "cpe:2.3:h:ifm_electronic:qha210:*:*:*:*:*:*:*:*", "model_numbers": [ "QHA210" ] } } } ], "category": "product_family", "name": "Hardware" } ], "category": "vendor", "name": "IFM" } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "moneo appliance <=1.9.3 installed on QHA210", "product_id": "CSAFPID-31001" }, "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-11001" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-3485", "cwe": { "id": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password" }, "notes": [ { "category": "description", "text": "In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.\n", "title": "CVE Description" } ], "product_status": { "known_affected": [ "CSAFPID-31001", "CSAFPID-51001" ] }, "remediations": [ { "category": "mitigation", "details": "The certificate is renewed by adjusting the hostname to an own customer-specific, so it does not contain the serial number.", "product_ids": [ "CSAFPID-51001", "CSAFPID-31001" ] }, { "category": "vendor_fix", "details": "The password-reset mechanism will be updated in a future version.\nWhen using automation components, make sure that no unauthorized access can take place. In addition, measures should be taken to ensure that the components do not have direct access to Internet resources and that they cannot be accessed from insecure networks. Use available security measures such as authentication and authorization groups.", "product_ids": [ "CSAFPID-51001", "CSAFPID-31001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-51001" ] } ], "title": "CVE-2022-3485" } ] } ```