Most recent entries from csaf_jumogmbhcokg

VDE-2026-071 — JUMO: Allegro RomPager webserver vulnerability in JUMO mTRONT, DICON touch, AQUIS touch devices

Tue, 23 Jun 2026 10:00:00 +0000

Multiple products from JUMO are affected by webserver vulnerability "CVE-2013-6786, CVE-2014-9222, CVE-2014-9223. This vulnerability leads to DOS of the device by using a misfortune cookie and reflected XSS attacks.

VDE-2026-009 — JUMO: Multiple products affected by nodejs vulnerability

Tue, 26 May 2026 07:00:00 +0000

A vulnerability in the REST API of the JUMO device allows an attacker to trigger a denial‑of‑service (DoS) condition. Due to an incorrect implementation of the arrayLimit option in the Node.js qs module, limits for incoming request parameters are not properly enforced. As a result, an attacker can send specially crafted requests containing excessively large or deeply nested arrays, causing the web server to become unresponsive. This condition leads to a crash of the web server, followed by an automatic restart of the device.

VDE-2025-086 — Jumo: Predictable debug-interface password in variTRON series

Mon, 10 Nov 2025 11:00:00 +0000

A vulnerability was identified in the variTRON password generation algorithm of the debug-interface. The PRNG is initialized with the current Unix Timestamp, thus the resulting password is predictable. With the password root-access to the UART and ssh Interface can be gained. The impact is limited, since the debug-interface has to be actively enabled by an authorized user and will be deactivated automatically after the next reboot of the device.