# Recent vulnerabilities from Lenze SE ## [vde-2026-089](https://vulnerability.circl.lu/vuln/vde-2026-089) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "CRITICAL" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The Lenze VPN client is vulnerable to a Remote Code Execution. The vulnerability would allow an attacker to perform a remote code execution on the computer running the client with elevated privileges.", "title": "Summary" }, { "category": "general", "text": "Please refer to the Lenze Cyber Security Documentation https://www.lenze.com/de-de/application-knowledge-base/artikel/312721/0 for further details.", "title": "General Recommendations" }, { "category": "legal_disclaimer", "text": "Lenze SE assumes no liability whatsoever for any kind of losses or consequential losses that occur by the distribution and/or use of this document. All information published in this document is provided on good faith by Lenze SE. Insofar as permissible by law, however, none of this information shall establish any guarantee, commitment or liability on the part of Lenze SE. Lenze SE reserves the right to change or update this document at any time.", "title": "Disclamer" }, { "category": "description", "text": "Update the Lenze VPN Client to the latest software Version (>= 1.4.7). For further instructions, see the vendor fix for this vulnerability.\n", "title": "Remidiation" }, { "category": "description", "text": "As the cloud environment blocks older versions of the Lenze VPN Client, you must update the Lenze VPN Client. If you attempt to connect to the VPN using an older version, an error message will appear stating: \"A newer version of the VPN client is required.\"", "title": "Mitigation" }, { "category": "description", "text": "By exploiting this vulnerability, an attacker could completely compromise the system.", "title": "Impact" } ], "publisher": { "category": "vendor", "contact_details": "psirt@lenze.com", "name": "Lenze SE", "namespace": "https://www.lenze.com" }, "references": [ { "category": "external", "summary": "Lenze SE has a Product Security Incident Response Team (PSIRT) with its own communication channel. Contact us via https://www.lenze.com/ and the Service and Cyber Security tab.", "url": "https://www.lenze.com/en-de/services/cyber-security" }, { "category": "external", "summary": "CERT@VDE Security Advisories for Lenze", "url": "https://certvde.com/en/advisories/vendor/lenze/" }, { "category": "self", "summary": "VDE-2026-089: Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway - HTML", "url": "https://certvde.com/en/advisories/VDE-2026-089" }, { "category": "self", "summary": "VDE-2026-089: Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway - CSAF", "url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-089.json" } ], "title": "Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway", "tracking": { "aliases": [ "VDE-2026-089" ], "current_release_date": "2026-09-21T16:00:00.000Z", "generator": { "date": "2026-09-21T09:25:01.009Z", "engine": { "name": "Secvisogram", "version": "2.6.12" } }, "id": "VDE-2026-089", "initial_release_date": "2026-09-21T16:00:00.000Z", "revision_history": [ { "date": "2026-09-21T16:00:00.000Z", "number": "1.0.0", "summary": "initial revision" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<1.4.7", "product": { "name": "Lenze VPN Client <1.4.7", "product_id": "CSAFPID-51001", "product_identification_helper": { "cpe": "cpe:2.3:a:lenze:vpnclient:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "1.4.7", "product": { "name": "Lenze VPN Client 1.4.7", "product_id": "CSAFPID-52001", "product_identification_helper": { "cpe": "cpe:2.3:a:lenze:vpnclient:1.4.7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Lenze VPN Client" } ], "category": "product_family", "name": "Software" } ], "category": "vendor", "name": "Lenze" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Luuk van Rheden" ], "organization": "IXON" } ], "cve": "CVE-2026-75925", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "description", "text": "Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-52001" ], "known_affected": [ "CSAFPID-51001" ] }, "references": [ { "category": "external", "summary": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - 9.6 / Critical", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "The Lenze VPN Client is available and downloadable via the Fleet Manager. Please update this Client. Obtain the update software (version >= 1.4.7) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following commands in an linux system:\n```\ntar -xzf vpn_client_x64.tar.gz\ncd vpn_client_x64\nsudo ./install\n```", "product_ids": [ "CSAFPID-51001" ] }, { "category": "mitigation", "details": "As the cloud environment blocks older versions of the Lenze VPN Client, you must update the Lenze VPN Client. If you attempt to connect to the VPN using an older version, an error message will appear stating: \"A newer version of the VPN client is required.\"", "product_ids": [ "CSAFPID-51001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001" ] } ], "title": "IXON VPN Client CRLF Injection" } ] } ``` ## [vde-2026-077](https://vulnerability.circl.lu/vuln/vde-2026-077) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "High" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The affected products belong to the Controller or Servo Drive product family and contain a vulnerability in a security-critical activation mechanism for service access. The signature verification of a file used for SSH activation can be compromised, which could allow unauthorized access to the device.", "title": "Summary" }, { "category": "general", "text": "The cyber security documentation currently describes some of the implemented functions and is thus intended to provide clarity in the functions described here.", "title": "General Recommendations" }, { "category": "legal_disclaimer", "text": "Lenze SE assumes no liability whatsoever for any kind of losses or consequential losses that occur by the distribution and/or use of this document . All information published in this document is provided on good faith by Lenze SE. Insofar as permissible by law, however, none of this information shall establish any guarantee, commitment or liability on the part of Lenze SE. Lenze SE reserves the right to change or update this document at any time.", "title": "Disclamer" }, { "category": "description", "text": "This vulnerability could compromise the confidentiality, integrity, and availability of the product.", "title": "Impact" }, { "category": "description", "text": "To resolve this security vulnerability, we recommend installing a firmware update.\n\n| Product | Firmware | Fixed Version |\n| --------------- | -------- | ------------- |\n| Controller c430 | c4xx | 1.15.2 |\n| c520 | c5xx | 1.15.2 |\n| c550 | c5xx | 1.15.2 |\n| i950 GenA | i950 | 1.15.0 |\n| i950 GenB | i950 | 2.0.3 |\n", "title": "Remediation" }, { "category": "description", "text": "Check to see if there is an activation file on the SD Card, and delete it. In addition, it is recommended that you protect each access path with appropriate measures, such as physically securing access to the SD Card, authorizing file transfers via PLC Designer (if supported by the respective product), authorizing file transfers via OPC UA (if supported by the respective product), and customizing the key for SFTP access.", "title": "Mitigation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@lenze.com", "name": "Lenze SE", "namespace": "https://www.lenze.com" }, "references": [ { "category": "external", "summary": "Lenze SE has a Product Security Incident Response Team (PSIRT) with its own communication channel. Contact us via https://www.lenze.com/ and the Service and Cyber Security tab.", "url": "https://www.lenze.com/en-de/services/cyber-security" }, { "category": "external", "summary": "CERT@VDE Security Advisories for Lenze", "url": "https://certvde.com/en/advisories/vendor/lenze/" }, { "category": "self", "summary": "VDE-2026-077: Lenze: Incorrect signature validation in the enable SSH routine - HTML", "url": "https://certvde.com/en/advisories/VDE-2026-077/" }, { "category": "self", "summary": "VDE-2026-077: Lenze: Incorrect signature validation in the enable SSH routine - CSAF", "url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-077.json" } ], "title": "Lenze: Incorrect signature validation in the enable SSH routine", "tracking": { "aliases": [ "VDE-2026-077" ], "current_release_date": "2026-07-27T10:00:00.000Z", "generator": { "date": "2026-07-24T08:14:14.889Z", "engine": { "name": "Secvisogram", "version": "2.6.4" } }, "id": "VDE-2026-077", "initial_release_date": "2026-07-27T10:00:00.000Z", "revision_history": [ { "date": "2026-07-27T10:00:00.000Z", "number": "1.0.0", "summary": "Initial release." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "c430", "product": { "name": "Controller c430", "product_id": "CSAFPID-13001", "product_identification_helper": { "cpe": "cpe:2.3:h:lenze:c430:*:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "c4x0" }, { "branches": [ { "category": "product_name", "name": "c520", "product": { "name": "Controller c520", "product_id": "CSAFPID-13002", "product_identification_helper": { "cpe": "cpe:2.3:h:lenze:c520:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "c550", "product": { "name": "Controller c550", "product_id": "CSAFPID-13003", "product_identification_helper": { "cpe": "cpe:2.3:h:lenze:c550:*:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "c5x0" }, { "branches": [ { "category": "product_name", "name": "i950 GenA", "product": { "name": "i950 Servo Inverter GenA", "product_id": "CSAFPID-13004", "product_identification_helper": { "cpe": "cpe:2.3:h:lenze:i950_gena:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "i950 GenB", "product": { "name": "i950 Servo Inverter GenB", "product_id": "CSAFPID-13005", "product_identification_helper": { "cpe": "cpe:2.3:h:lenze:i950_genb:*:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "i9x0" } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<1.15.2", "product": { "name": "Firmware c4x0 <1.15.2", "product_id": "CSAFPID-21001", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c4xx_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "1.15.2", "product": { "name": "Firmware c4x0 1.15.3", "product_id": "CSAFPID-22001", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c4xx_firmware:1.15.2:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Firmware c4xx" }, { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<1.15.2", "product": { "name": "Firmware c5x0 <1.15.2", "product_id": "CSAFPID-21002", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c5xx_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "1.15.2", "product": { "name": "Firmware c5x0 1.15.3", "product_id": "CSAFPID-22002", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c5xx_firmware:1.15.2:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Firmware c5xx" }, { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<1.14.2", "product": { "name": "Firmware i950 <1.14.2", "product_id": "CSAFPID-21003", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "1.15.0", "product": { "name": "Firmware i950 1.14.3", "product_id": "CSAFPID-22003", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:1.15.0:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:semver/>=2.0.0|<2.0.3", "product": { "name": "Firmware i950 <2.0.2", "product_id": "CSAFPID-21004", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "2.0.3", "product": { "name": "Firmware i950 2.0.3", "product_id": "CSAFPID-22004", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:2.0.3:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Firmware i950" } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "Lenze" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ], "summary": "Affected Products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005" ], "summary": "Fixed Products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware c4xx <1.15.2 installed on Controller c430", "product_id": "CSAFPID-31001", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c4xx_firmware:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-13001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware c4xx 1.15.2 installed on Controller c430", "product_id": "CSAFPID-32001", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c4xx_firmware:1.15.2:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-13001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware c5xx <1.15.2 installed on Controller c520", "product_id": "CSAFPID-31002", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c5xx_firmware:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-13002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware c5xx <1.15.2 installed on c550", "product_id": "CSAFPID-31003", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c5xx_firmware:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-13003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware c5xx 1.15.2 installed on c520", "product_id": "CSAFPID-32002", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c5xx_firmware:1.15.2:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-13002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware c5xx 1.15.2 installed on c550", "product_id": "CSAFPID-32003", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:c5xx_firmware:1.15.2:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-13003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware i950 <1.14.2 installed on i950 GenA", "product_id": "CSAFPID-31004", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-13004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware i950 1.15.0 installed on i950 GenA", "product_id": "CSAFPID-32004", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:1.15.0:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22003", "relates_to_product_reference": "CSAFPID-13004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware i950 <2.0.3 installed on i950 GenB", "product_id": "CSAFPID-31005", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:*:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-13005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware i950 2.0.3 installed on i950 GenB", "product_id": "CSAFPID-32005", "product_identification_helper": { "cpe": "cpe:2.3:o:lenze:i950_firmware:2.0.3:*:*:*:*:*:*:*" } }, "product_reference": "CSAFPID-22004", "relates_to_product_reference": "CSAFPID-13005" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-14837", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "notes": [ { "category": "description", "text": "Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] }, "references": [ { "category": "external", "summary": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - 8.5 / High", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "remediations": [ { "category": "vendor_fix", "details": "To resolve this security vulnerability, we recommend installing a firmware update.\n\n| Product | Firmware | Fixed Version |\n| --------------- | -------- | ------------- |\n| Controller c430 | c4xx | 1.15.2 |\n| c520 | c5xx | 1.15.2 |\n| c550 | c5xx | 1.15.2 |\n| i950 GenA | i950 | 1.15.0 |\n| i950 GenB | i950 | 2.0.3 |\n", "group_ids": [ "CSAFGID-0001" ] }, { "category": "mitigation", "details": "Check to see if there is an activation file on the SD Card, and delete it. In addition, it is recommended that you protect each access path with appropriate measures, such as physically securing access to the SD Card, authorizing file transfers via PLC Designer (if supported by the respective product), authorizing file transfers via OPC UA (if supported by the respective product), and customizing the key for SFTP access.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005" ] } ], "title": "SSH Enablement Signature Verification Bypass" } ] } ``` ## [vde-2025-043](https://vulnerability.circl.lu/vuln/vde-2025-043) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/calculator/3.1", "text": "Medium" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "A security vulnerability was discovered in the PLC Designer V4 in the version 4.0.0 where the programmer of a Controller can set a password for the connected device. Here it is possible in an interface of the PLC Designer V4 for the programmer to enter a password for the Device. There is a special constellation where the password entered appears in plain text. Only the display in the tool is affected and not the management of the password on the device. This vulnerability of PLC Designer V4 only occurs in combination with the devices c430 controller, c520 controller and c550 controller and not in combination with other devices, as this functionality is only used here. It is generally recommended that all users update to 4.0.1, but especially all users who operate PLC Designer V4 in combination with the controllers mentioned.", "title": "Summary" }, { "category": "general", "text": "The cyber security documentation currently describes some of the implemented functions and is thus intended to provide clarity in the functions described here. ", "title": "General Recommendations" }, { "category": "legal_disclaimer", "text": "Lenze SE assumes no liability whatsoever for any kind of losses or consequential losses that occur by the distribution and/or use of this document . All information published in this document is provided on good faith by Lenze SE. Insofar as permissible by law, however, none of this information shall establish any guarantee, commitment or liability on the part of Lenze SE. Lenze SE reserves the right to change or update this document at any time.", "title": "Disclamer" }, { "category": "description", "text": "This vulnerability may lead to unintended exposure of passwords in plain text within the PLC Designer V4 interface, potentially allowing unauthorized individuals with access to the engineering workstation to view sensitive credentials. The issue is limited to versions 4.0.0 used with c430, c520, and c550 controllers, and does not affect password handling on the device itself.", "title": "Impact" }, { "category": "description", "text": "The PLC Designer V4 tool is designed and developed for use in closed and protected security zones. Lenze therefore strongly recommends that this tool is only used in familiar areas. As this security vulnerability relates to a plain text display of an entered password and not to the password method saved afterwards, it is recommended as mitigation to protect the viewing area of the tool from strangers when entering it in order to prevent the shoulder surfing attack method.", "title": "Mitigation" }, { "category": "description", "text": "This vulnerability has been fixed in the new version. All users are strongly recommended to use the new version 4.0.1.", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@lenze.com", "name": "Lenze SE", "namespace": "https://www.lenze.com" }, "references": [ { "category": "external", "summary": "Lenze SE Product Security Incident Response Team (PSIRT)", "url": "https://www.lenze.com/en-de/services/cyber-security" }, { "category": "external", "summary": "https://www.lenze.com/en-de/services/cyber-security", "url": "https://certvde.com/en/advisories/vendor/lenze/" }, { "category": "self", "summary": "VDE-2025-043: Lenze: PLC Designer V4 with insecure storage of sensitive information - HTML", "url": "https://certvde.com/en/advisories/VDE-2025-043/" }, { "category": "self", "summary": "VDE-2025-043: Lenze: PLC Designer V4 with insecure storage of sensitive information - CSAF", "url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-043.json" } ], "title": "Lenze: PLC Designer V4 with insecure storage of sensitive information", "tracking": { "aliases": [ "VDE-2025-043" ], "current_release_date": "2025-06-25T10:00:00.000Z", "generator": { "date": "2025-06-23T08:21:40.731Z", "engine": { "name": "Secvisogram", "version": "2.5.27" } }, "id": "VDE-2025-043", "initial_release_date": "2025-06-25T10:00:00.000Z", "revision_history": [ { "date": "2025-06-25T10:00:00.000Z", "number": "1", "summary": "Initial Version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "4.0.0", "product": { "name": "PLC Designer V4 4.0.0", "product_id": "CSAFPID-51001" } }, { "category": "product_version", "name": "4.0.1", "product": { "name": "PLC Designer V4 4.0.1", "product_id": "CSAFPID-52001" } } ], "category": "product_name", "name": "PLC Designer V4" } ], "category": "product_family", "name": "Software" } ], "category": "vendor", "name": "Lenze" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-41647", "cwe": { "id": "CWE-312", "name": "Cleartext Storage of Sensitive Information" }, "notes": [ { "category": "description", "text": "A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.", "title": "Description" } ], "product_status": { "fixed": [ "CSAFPID-52001" ], "known_affected": [ "CSAFPID-51001" ] }, "remediations": [ { "category": "vendor_fix", "details": "This vulnerability has been fixed in the new version. All users are strongly recommended to use the new version 4.0.1.", "product_ids": [ "CSAFPID-51001" ] }, { "category": "mitigation", "details": "The PLC Designer V4 tool is designed and developed for use in closed and protected security zones. Lenze therefore strongly recommends that this tool is only used in familiar areas. As this security vulnerability relates to a plain text display of an entered password and not to the password method saved afterwards, it is recommended as mitigation to protect the viewing area of the tool from strangers when entering it in order to prevent the shoulder surfing attack method.", "product_ids": [ "CSAFPID-51001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-51001" ] } ], "title": "CVE-2025-41647" } ] } ``` ## [vde-2025-042](https://vulnerability.circl.lu/vuln/vde-2025-042) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/calculator/3.1", "text": "High" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The Lenze VPN client is vulnerable to a Local Privilege Escalation to root/SYSTEM by executing a configuration file which can be controlled by a non-privileged user. This occurs through a race condition exploit, where an attacker can overwrite the temporary OpenVPN configuration file located in a world-writable directory. By injecting malicious commands into the configuration file prior to its execution by the VPN client, an attacker can trigger arbitrary code execution with root/system privileges when a VPN connection is initiated. The vulnerability has been remediated in the version 1.4.4 of the Lenze VPN client.\nDue to some further developments and completion of the functional scope, it is recommended to update the firmware of the x500 IoT Gateway devices immediately, regardless of the current security vulnerability in the VPN client.", "title": "Summary" }, { "category": "general", "text": "The cyber security documentation currently describes some of the implemented functions and is thus intended to provide clarity in the functions described here.", "title": "General Recommendations" }, { "category": "legal_disclaimer", "text": "Lenze SE assumes no liability whatsoever for any kind of losses or consequential losses that occur by the distribution and/or use of this document . All information published in this document is provided on good faith by Lenze SE. Insofar as permissible by law, however, none of this information shall establish any guarantee, commitment or liability on the part of Lenze SE. Lenze SE reserves the right to change or update this document at any time.", "title": "Disclamer" }, { "category": "description", "title": "Impact", "text": "This vulnerability allows local non-privileged users to escalate their privileges to root or SYSTEM by exploiting a race condition in the Lenze VPN Client. Successful exploitation could lead to full system compromise, enabling attackers to execute arbitrary code with elevated privileges." }, { "category": "description", "title": "Remediation", "text": "Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following\ncommands in an linux system: \ntar -xzf vpn_client_x64.tar.gz \ncd vpn_client_x64 \nsudo ./install" } ], "publisher": { "category": "vendor", "contact_details": "psirt@lenze.com", "name": "Lenze SE", "namespace": "https://www.lenze.com" }, "references": [ { "category": "external", "summary": "Lenze SE Product Security Incident Response Team (PSIRT)", "url": "https://www.lenze.com/en-de/services/cyber-security" }, { "category": "external", "summary": "CERT@VDE Security Advisories for Lenze", "url": "https://certvde.com/en/advisories/vendor/lenze/" }, { "category": "self", "summary": "VDE-2025-042: Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway - HTML", "url": "https://certvde.com/en/advisories/VDE-2025-042/" }, { "category": "self", "summary": "VDE-2025-042: Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway - CSAF", "url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-042.json" } ], "title": "Lenze: VPN Client Privilege Escalation in combination with Lenze x500 IoT Gateway", "tracking": { "aliases": [ "VDE-2025-042" ], "current_release_date": "2025-05-27T09:00:00.000Z", "generator": { "date": "2025-05-23T08:15:39.225Z", "engine": { "name": "Secvisogram", "version": "2.5.25" } }, "id": "VDE-2025-042", "initial_release_date": "2025-05-27T09:00:00.000Z", "revision_history": [ { "date": "2025-05-27T09:00:00.000Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "x510", "product": { "name": "x510", "product_id": "CSAFPID-11001" } }, { "category": "product_name", "name": "x520", "product": { "name": "x520", "product_id": "CSAFPID-11002" } }, { "name": "x530", "category": "product_name", "product": { "name": "x530", "product_id": "CSAFPID-11003" } }, { "name": "x540", "category": "product_name", "product": { "name": "x540", "product_id": "CSAFPID-11004" } } ], "category": "product_family", "name": "x500" } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Firmware x510 vers:all/*", "product_id": "CSAFPID-21001" } } ], "category": "product_name", "name": "x510" }, { "category": "product_name", "name": "x520", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Firmware x520 vers:all/*", "product_id": "CSAFPID-21002" } } ] }, { "category": "product_name", "name": "x530", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Firmware x530 vers:all/*", "product_id": "CSAFPID-21003" } } ] }, { "name": "x540", "category": "product_name", "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Firmware x540 vers:all/*", "product_id": "CSAFPID-21004" } } ] } ], "category": "product_family", "name": "Firmware" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "<1.4.4", "product": { "name": "Lenze VPN Client <1.4.4", "product_id": "CSAFPID-51001" } }, { "category": "product_version", "name": "1.4.4", "product": { "name": "Lenze VPN Client 1.4.4", "product_id": "CSAFPID-52001" } } ], "category": "product_name", "name": "Lenze VPN Client" } ], "category": "product_family", "name": "Software" } ], "category": "vendor", "name": "Lenze" } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware x510 vers:all/* installed on x510", "product_id": "CSAFPID-31001" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "external_component_of", "full_product_name": { "name": "Lenze VPN Client <1.4.4 external component of Firmware x510 vers:all/* installed on x510", "product_id": "CSAFPID-31002" }, "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-31001" }, { "category": "external_component_of", "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-31001", "full_product_name": { "name": "Lenze VPN Client 1.4.4 external component of Firmware x510 vers:all/* installed on x510", "product_id": "CSAFPID-32001" } }, { "category": "installed_on", "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11002", "full_product_name": { "name": "Firmware x520 vers:all/* installed on x520", "product_id": "CSAFPID-31003" } }, { "category": "external_component_of", "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-31003", "full_product_name": { "name": "Lenze VPN Client <1.4.4 external component of Firmware x520 vers:all/* installed on x520", "product_id": "CSAFPID-31004" } }, { "category": "external_component_of", "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-31003", "full_product_name": { "name": "Lenze VPN Client 1.4.4 external component of Firmware x520 vers:all/* installed on x520", "product_id": "CSAFPID-32002" } }, { "category": "installed_on", "product_reference": "CSAFPID-21003", "relates_to_product_reference": "CSAFPID-11003", "full_product_name": { "name": "Firmware x530 vers:all/* installed on x530", "product_id": "CSAFPID-31005" } }, { "category": "external_component_of", "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-31005", "full_product_name": { "name": "Lenze VPN Client <1.4.4 external component of Firmware x530 vers:all/* installed on x530", "product_id": "CSAFPID-31006" } }, { "category": "external_component_of", "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-31005", "full_product_name": { "name": "Lenze VPN Client 1.4.4 external component of Firmware x530 vers:all/* installed on x530", "product_id": "CSAFPID-32003" } }, { "category": "installed_on", "product_reference": "CSAFPID-21004", "relates_to_product_reference": "CSAFPID-11004", "full_product_name": { "name": "Firmware x540 vers:all/* installed on x540", "product_id": "CSAFPID-31007" } }, { "category": "external_component_of", "product_reference": "CSAFPID-51001", "relates_to_product_reference": "CSAFPID-31007", "full_product_name": { "name": "Lenze VPN Client <1.4.4 external component of Firmware x540 vers:all/* installed on x540", "product_id": "CSAFPID-31008" } }, { "category": "external_component_of", "product_reference": "CSAFPID-52001", "relates_to_product_reference": "CSAFPID-31007", "full_product_name": { "name": "Lenze VPN Client 1.4.4 external component of Firmware x540 vers:all/* installed on x540", "product_id": "CSAFPID-32004" } } ], "product_groups": [ { "group_id": "CSAFGID-0001", "summary": "Affected products.", "product_ids": [ "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31006", "CSAFPID-31008" ] }, { "group_id": "CSAFGID-0002", "summary": "Fixed products.", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004" ] } ] }, "vulnerabilities": [ { "cve": "CVE-2025-26168", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "summary", "text": "IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004" ], "known_affected": [ "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31006", "CSAFPID-31008" ] }, "remediations": [ { "category": "vendor_fix", "details": "Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following\ncommands in an linux system: \ntar -xzf vpn_client_x64.tar.gz \ncd vpn_client_x64 \nsudo ./install", "product_ids": [ "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31006", "CSAFPID-31008" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31006", "CSAFPID-31008" ] } ], "title": "CVE-2025-26168" }, { "cve": "CVE-2025-26169", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "description", "text": "IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten.", "title": "Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004" ], "known_affected": [ "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31006", "CSAFPID-31008" ] }, "remediations": [ { "category": "vendor_fix", "details": "Obtain the updated VPN software (version >= 1.4.4) from https://cloud.lenze.digital/fleet-manager/tools and run the installer on a windows and macOS system or run the following\ncommands in an linux system: \ntar -xzf vpn_client_x64.tar.gz \ncd vpn_client_x64 \nsudo ./install", "product_ids": [ "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31006", "CSAFPID-31008" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31002", "CSAFPID-31004", "CSAFPID-31006", "CSAFPID-31008" ] } ], "title": "CVE-2025-26169" } ] } ``` ## [vde-2024-053](https://vulnerability.circl.lu/vuln/vde-2024-053) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "organization": "Lenze SE", "summary": "reporting", "urls": [ "https://www.lenze.com/en-us" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The following tools:\n* VisiWinNET Smart\n* VisiWinNET Professional\n* EASY UI Designer \ncreate a directory with insufficient permissions, allowing a low-level user the ability to add and modify certain files that hold SYSTEM privileges, which could lead to privilege escalation.", "title": "Summary" }, { "category": "description", "text": "The vulnerability allows a low-level user to escalate privileges to SYSTEM, which could lead to full system compromise.", "title": "Impact" }, { "category": "description", "text": "Only use this tool in a protected and controlled environment to minimize network impact and to ensure that the tool is inaccessable from outside. In addition, the use of firewalls is recommended to reduce the attack surface, specially to the internet and the internal business network.", "title": "Mitigation" }, { "category": "description", "text": "Lenze has released version 1.6.1 of the EASY UI Designer tool, which fixes the identified security vulnerability. The other two tools are no longer recommended for new applications and are being prepared for discontinuation.", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "psirt@lenze.com", "name": "Lenze SE", "namespace": "https://www.lenze.com" }, "references": [ { "category": "external", "summary": "CERT@VDE Security Advisories for Lenze SE", "url": "https://certvde.com/en/advisories/vendor/lenze/" }, { "category": "self", "summary": "VDE-2024-053: Lenze: Install Directory with insufficient permissions - HTML", "url": "https://certvde.com/en/advisories/VDE-2024-053" }, { "summary": "VDE-2024-053: Lenze: Install Directory with insufficient permissions - CSAF", "url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2024-053.json", "category": "self" } ], "title": "Lenze: Install Directory with insufficient permissions", "tracking": { "aliases": [ "VDE-2024-053" ], "current_release_date": "2025-03-13T11:30:00.000Z", "generator": { "date": "2025-03-19T15:02:53.134Z", "engine": { "name": "Secvisogram", "version": "2.5.21" } }, "id": "VDE-2024-053", "initial_release_date": "2024-09-03T08:00:00.000Z", "revision_history": [ { "date": "2024-08-21T07:00:00.000Z", "number": "1", "summary": "Initial revision." }, { "date": "2024-11-06T11:27:01.000Z", "number": "2", "summary": "Fix: correct certvde domain, added self-reference" }, { "date": "2025-03-13T11:30:00.000Z", "number": "3", "summary": "Fix: product version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "EASY UI Designer", "product": { "name": "Lenze EASY UI Designer", "product_id": "CSAFPID-11001" } }, { "category": "product_name", "name": "VisiWinNET Smart", "product": { "name": "Lenze VisiWinNET Smart", "product_id": "CSAFPID-11002" } }, { "category": "product_name", "name": "VisiWinNET Professional", "product": { "name": "Lenze VisiWinNET Professional", "product_id": "CSAFPID-11003" } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Firmware vers:all/*", "product_id": "CSAFPID-21001" } }, { "category": "product_version_range", "name": "<1.6.0", "product": { "name": "Firmware <1.6.0", "product_id": "CSAFPID-21002" } }, { "category": "product_version", "name": "1.6.1", "product": { "name": "Firmware 1.6.1", "product_id": "CSAFPID-22001" } } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "Lenze" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ], "summary": "Affected products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware <1.6.0 installed on Lenze EASY UI Designer", "product_id": "CSAFPID-31001" }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on Lenze VisiWinNET Smart", "product_id": "CSAFPID-31002" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware vers:all/* installed on Lenze VisiWinNET Professional", "product_id": "CSAFPID-31003" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware 1.6.1 installed on Lenze EASY UI Designer", "product_id": "CSAFPID-32001" }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-31468", "cwe": { "id": "CWE-276", "name": "Incorrect Default Permissions" }, "notes": [ { "audience": "all", "category": "description", "text": "An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The \"%PROGRAMFILES(X86)%\\INOSOFT GmbH\" folder has weak permissions for Everyone, allowing an attacker to insert a Trojan horse file that runs as SYSTEM. 2024-1 is a fixed version.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-32001" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] }, "remediations": [ { "category": "mitigation", "details": "Only use this tool in a protected and controlled environment to minimize network impact and to ensure that the tool is inaccessable from outside. In addition, the use of firewalls is recommended to reduce the attack surface, specially to the internet and the internal business network.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": "Lenze has released version 1.6.1 of the EASY UI Designer tool, which fixes the identified security vulnerability. The other two tools are no longer recommended for new applications and are being prepared for discontinuation.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003" ] } ], "title": "CVE-2023-31468" } ] } ``` ## [vde-2022-030](https://vulnerability.circl.lu/vuln/vde-2022-030) ```json { "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The machine controller of the cabinet series include an OPC-UA server which uses an user management to authenticate clients via anonymous or user/password authentication. If the user/password authentication is selected, password verification is skipped upon second login. As a result, cases occur in which users can establish communication without correct authentication. This vulnerability is not located in the OPC-UA protocol or server, but in the interface to the products firmware.\n\nThis Security Advisory is only relevant for the following use cases:\n\n• the user management has been activated on the machine controller (is deactivated by default)\n\n• the OPC-UA Server is used\n\n• Data are transferred via a symbol configuration (is not available by default)", "title": "Summary" }, { "category": "description", "text": "The exploitation of the missing critical step in authentication may result in unauthorized use of the OPC-UA interface.", "title": "Impact" }, { "category": "description", "text": "As part of a security strategy, Lenze SE recommends the following general defense measures to reduce the risk of exploits:\n\n• Only use the products in a protected and controlled environment to minimize network impact and to ensure that they are inaccessible from outside.\n\n• Use external firewalls to protect the automation system network and to separate it from other networks. Remark: One Measure should be to block port 4840 via the external firewall and open this port for authenticated access only.\n\n• Use Virtual Private Networks (VPN) tunnels when remote access is required.\n\n• Use IDS (Intrusion Detection Systems) where possible to detect anomalies in the network.\n\n• Activate and use user administration and password functions.\n\n• Use encrypted communication links.\n\n• Restrict access to both the development tools and their projects and the products of the automation system by physical means, operating system functions, etc.\n\n• Protect the development tool by using the latest virus detection solutions.\n\n• Use of certificate-based communication via the message security modes Sign or Sign&Encrypt and trust of the corresponding client certificates on the machine controller by the OPC-UA server. This can reduce the risk of exploiting this vulnerability.", "title": "Mitigation" }, { "category": "description", "text": "Install version V01.08.01.3021, which solves the identified security vulnerability.", "title": "Remediation" } ], "publisher": { "contact_details": "psirt@lenze.com", "name": "Lenze SE", "namespace": "https://www.lenze.com", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-030: Lenze: Vulnerability in the OPC-UA authentification connection in the firmware - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-030/" }, { "category": "self", "summary": "VDE-2022-030: Lenze: Vulnerability in the OPC-UA authentification connection in the firmware - CSAF", "url": "https://lenze.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-030.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.lenze.com" }, { "category": "external", "summary": "CERT@VDE Security Advisories for Lenze SE", "url": "https://certvde.com/en/advisories/vendor/lenze/" } ], "title": "Lenze: Vulnerability in the OPC-UA authentification connection in the firmware", "tracking": { "aliases": [ "VDE-2022-030" ], "current_release_date": "2022-07-11T10:00:00.000Z", "generator": { "date": "2025-04-23T18:36:11.196Z", "engine": { "name": "Secvisogram", "version": "2.5.23" } }, "id": "VDE-2022-030", "initial_release_date": "2022-07-11T10:00:00.000Z", "revision_history": [ { "date": "2022-07-11T10:00:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "name": "Lenze", "category": "vendor", "branches": [ { "name": "Hardware", "category": "product_family", "branches": [ { "name": "cabinet c520", "category": "product_name", "product": { "name": "cabinet c520", "product_id": "CSAFPID-11001" } }, { "name": "cabinet c550", "category": "product_name", "product": { "name": "cabinet c550", "product_id": "CSAFPID-11002" } }, { "name": "cabinet c750", "category": "product_name", "product": { "name": "cabinet c750", "product_id": "CSAFPID-11003" } } ] }, { "name": "Firmware", "category": "product_family", "branches": [ { "name": "V01.07.00.2757