https://vulnogram.org/ Most recent CVEs assigned by CERT@VDE (certvde). https://vulnogram.org/seaview/icons/certvde.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-107564 https://vulnogram.org/CVE-2026-107564 An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service. High Network Exploitable Fri, 16 Oct 2026 12:55:24 GMT https://vulnogram.org/CVE-2026-94410 https://vulnogram.org/CVE-2026-94410 A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected. Medium Tue, 13 Oct 2026 11:37:32 GMT https://vulnogram.org/CVE-2026-94293 https://vulnogram.org/CVE-2026-94293 An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints. Critical Network Exploitable Tue, 06 Oct 2026 06:38:04 GMT https://vulnogram.org/CVE-2025-41753 https://vulnogram.org/CVE-2025-41753 The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it a… Critical Network Exploitable Thu, 01 Oct 2026 06:42:00 GMT https://vulnogram.org/CVE-2026-76992 https://vulnogram.org/CVE-2026-76992 The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive me… High Network Exploitable Wed, 30 Sep 2026 11:07:45 GMT https://vulnogram.org/CVE-2026-79625 https://vulnogram.org/CVE-2026-79625 Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remot… High Wed, 30 Sep 2026 09:23:16 GMT https://vulnogram.org/CVE-2026-27565 https://vulnogram.org/CVE-2026-27565 An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot. Critical Network Exploitable Wed, 16 Sep 2026 07:52:23 GMT https://vulnogram.org/CVE-2026-27564 https://vulnogram.org/CVE-2026-27564 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:52:14 GMT https://vulnogram.org/CVE-2026-27563 https://vulnogram.org/CVE-2026-27563 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:52:04 GMT https://vulnogram.org/CVE-2026-27562 https://vulnogram.org/CVE-2026-27562 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:51:54 GMT https://vulnogram.org/CVE-2026-27561 https://vulnogram.org/CVE-2026-27561 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:51:34 GMT https://vulnogram.org/CVE-2026-27560 https://vulnogram.org/CVE-2026-27560 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:51:18 GMT https://vulnogram.org/CVE-2026-27559 https://vulnogram.org/CVE-2026-27559 A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:50:58 GMT https://vulnogram.org/CVE-2026-27558 https://vulnogram.org/CVE-2026-27558 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the devic… High Wed, 16 Sep 2026 07:50:45 GMT https://vulnogram.org/CVE-2026-27557 https://vulnogram.org/CVE-2026-27557 An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read. High Network Exploitable Wed, 16 Sep 2026 07:50:32 GMT https://vulnogram.org/CVE-2026-27556 https://vulnogram.org/CVE-2026-27556 A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device. High Wed, 16 Sep 2026 07:50:20 GMT https://vulnogram.org/CVE-2026-27555 https://vulnogram.org/CVE-2026-27555 A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device. High Wed, 16 Sep 2026 07:50:08 GMT https://vulnogram.org/CVE-2026-27554 https://vulnogram.org/CVE-2026-27554 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:49:58 GMT https://vulnogram.org/CVE-2026-27553 https://vulnogram.org/CVE-2026-27553 A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes. Medium Wed, 16 Sep 2026 07:49:48 GMT https://vulnogram.org/CVE-2026-27552 https://vulnogram.org/CVE-2026-27552 A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes. High Wed, 16 Sep 2026 07:49:32 GMT https://vulnogram.org/CVE-2026-27551 https://vulnogram.org/CVE-2026-27551 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:49:22 GMT https://vulnogram.org/CVE-2026-27550 https://vulnogram.org/CVE-2026-27550 A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:49:12 GMT https://vulnogram.org/CVE-2026-27549 https://vulnogram.org/CVE-2026-27549 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:48:59 GMT https://vulnogram.org/CVE-2026-27548 https://vulnogram.org/CVE-2026-27548 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:48:48 GMT https://vulnogram.org/CVE-2026-27547 https://vulnogram.org/CVE-2026-27547 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device. High Wed, 16 Sep 2026 07:48:31 GMT https://vulnogram.org/CVE-2026-27546 https://vulnogram.org/CVE-2026-27546 An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured. Critical Network Exploitable Wed, 16 Sep 2026 07:48:15 GMT https://vulnogram.org/CVE-2026-78319 https://vulnogram.org/CVE-2026-78319 A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execu… Critical Network Exploitable Tue, 01 Sep 2026 06:44:51 GMT https://vulnogram.org/CVE-2026-81625 https://vulnogram.org/CVE-2026-81625 A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system. High Thu, 27 Aug 2026 09:06:44 GMT https://vulnogram.org/CVE-2026-63587 https://vulnogram.org/CVE-2026-63587 The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempt… High Network Exploitable Tue, 25 Aug 2026 08:55:12 GMT https://vulnogram.org/CVE-2026-63586 https://vulnogram.org/CVE-2026-63586 The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via t… Critical Network Exploitable Tue, 25 Aug 2026 08:54:55 GMT https://vulnogram.org/CVE-2026-8173 https://vulnogram.org/CVE-2026-8173 The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthen… Medium Network Exploitable Mon, 24 Aug 2026 06:47:58 GMT https://vulnogram.org/CVE-2026-14953 https://vulnogram.org/CVE-2026-14953 A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php. Medium Thu, 20 Aug 2026 08:20:06 GMT https://vulnogram.org/CVE-2026-14952 https://vulnogram.org/CVE-2026-14952 An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed ra… High Network Exploitable Thu, 20 Aug 2026 08:19:46 GMT https://vulnogram.org/CVE-2026-14951 https://vulnogram.org/CVE-2026-14951 An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages. High Thu, 20 Aug 2026 08:19:35 GMT https://vulnogram.org/CVE-2026-14950 https://vulnogram.org/CVE-2026-14950 An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable u… Critical Network Exploitable Thu, 20 Aug 2026 08:19:26 GMT https://vulnogram.org/CVE-2026-14949 https://vulnogram.org/CVE-2026-14949 A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the appli… High Thu, 20 Aug 2026 08:19:11 GMT https://vulnogram.org/CVE-2026-14948 https://vulnogram.org/CVE-2026-14948 A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives. High Thu, 20 Aug 2026 08:19:00 GMT https://vulnogram.org/CVE-2026-14947 https://vulnogram.org/CVE-2026-14947 A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary c… High Thu, 20 Aug 2026 08:18:49 GMT https://vulnogram.org/CVE-2026-14946 https://vulnogram.org/CVE-2026-14946 A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise. High Thu, 20 Aug 2026 08:18:37 GMT https://vulnogram.org/CVE-2025-41771 https://vulnogram.org/CVE-2025-41771 An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact… Medium Wed, 12 Aug 2026 08:06:48 GMT https://vulnogram.org/CVE-2025-41770 https://vulnogram.org/CVE-2025-41770 An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext serv… High Network Exploitable Wed, 12 Aug 2026 08:06:26 GMT https://vulnogram.org/CVE-2025-41769 https://vulnogram.org/CVE-2025-41769 The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code. Critical Network Exploitable Wed, 12 Aug 2026 08:05:54 GMT https://vulnogram.org/CVE-2026-9593 https://vulnogram.org/CVE-2026-9593 A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected… High Mon, 03 Aug 2026 06:28:19 GMT https://vulnogram.org/CVE-2026-7849 https://vulnogram.org/CVE-2026-7849 Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root. Critical Network Exploitable Thu, 30 Jul 2026 06:54:03 GMT https://vulnogram.org/CVE-2026-44108 https://vulnogram.org/CVE-2026-44108 Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unaut… Critical Network Exploitable Thu, 30 Jul 2026 06:53:42 GMT https://vulnogram.org/CVE-2026-44107 https://vulnogram.org/CVE-2026-44107 A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-… High Network Exploitable Thu, 30 Jul 2026 06:53:28 GMT https://vulnogram.org/CVE-2026-44105 https://vulnogram.org/CVE-2026-44105 The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted. Medium Thu, 30 Jul 2026 06:53:13 GMT https://vulnogram.org/CVE-2026-44106 https://vulnogram.org/CVE-2026-44106 A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise. High Thu, 30 Jul 2026 06:52:58 GMT https://vulnogram.org/CVE-2026-44104 https://vulnogram.org/CVE-2026-44104 The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full… Critical Network Exploitable Thu, 30 Jul 2026 06:52:31 GMT https://vulnogram.org/CVE-2026-44103 https://vulnogram.org/CVE-2026-44103 An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the… Medium Network Exploitable Thu, 30 Jul 2026 06:52:07 GMT