Most recent entries from csaf_pilzgmbhcokg

VDE-2020-033 — Pilz: Multiple products prone to WIBU-SYSTEMS CodeMeter vulnerabilities

Thu, 10 Sep 2020 13:18:00 +0000

A number of Pilz software tools use the Software CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to change and falsify a licence file, prevent normal operation of Code- Meter (Denial-of-Service) and potentially execute arbitrary code.

VDE-2021-009 — Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities

Mon, 20 Sep 2021 11:56:00 +0000

Multiple products of PILZ utilise a third-party TCP/IP implementation - the "Niche Ethernet Stack". This TCP/IP stack contains multiple vulnerabilities which are therefore affecting the products listed above.

VDE-2021-054 — Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system

Tue, 26 Apr 2022 10:00:00 +0000

Several Pilz products use Versions V2 and V3 of the CODESYS runtime system from CODESYS GmbH, which enables the execution of IEC 61131-3 PLC programs. These runtime environments contain several vulnerabilities, which an attacker can exploit via the network. Successful exploitation of the vulnerabilities results in reduced availability and, in a worst case, to the insertion of program code.

VDE-2021-055 — Pilz: PMC programming tool 2.x.x affected by multiple vulnerabilities

Tue, 26 Apr 2022 10:00:00 +0000

The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.

VDE-2021-061 — Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities

Tue, 26 Apr 2022 10:00:00 +0000

VDE-2022-033 — Pilz: PASvisu and PMI affected by multiple vulnerabilities

Thu, 24 Nov 2022 09:00:00 +0000

PASvisu is an HMI solution for Machine Visualization. It is available as a standalone software product, but it is also included in various models of the PMI product family. The PASvisu Server component contains multiple vulnerabilities which can be utilised to write arbitrary files, potentially leading to code execution.

VDE-2022-044 — Pilz: Multiple products affected by ZipSlip

Thu, 24 Nov 2022 09:00:00 +0000

Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.

VDE-2022-045 — Pilz: PAS 4000 prone to ZipSlip

Thu, 24 Nov 2022 09:00:00 +0000

PAS4000 is the software platform for the Automation System PSS 4000. PAS 4000 does not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.

VDE-2023-033 — Pilz: WIBU Vulnerabilitiy in multiple Products

Thu, 12 Oct 2023 06:00:00 +0000

Several Pilz products use the 3rd party component "CodeMeter Runtime" from WIBU-SYSTEM AG to manage software licenses. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. The vulnerability can be exploited locally or over the network.

Update A, 2023-12-05

changed affected version of "Software PASvisu < 1.15.0" to "Software PASvisu < 1.14.1" removed CVE-2023-4701 because it was revoked.

VDE-2023-048 — Pilz: Multiple products prone to libwebp vulnerability

Tue, 05 Dec 2023 07:00:00 +0000

Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the affected product, the vulnerabilities can be exploited locally or over the network.