Most recent entries from csaf_trumpfsecokg

VDE-2020-039 — TRUMPF: Multiple products prone to WIBU CodeMeter vulnerabilities

Tue, 27 Oct 2020 10:28:00 +0000

A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.

VDE-2021-011 — TRUMPF Laser GmbH: TruControl 2.14.0 to 3.14.0 affected by recent sudo vulnerability

Mon, 22 Mar 2021 08:59:00 +0000

TruControl laser control software from versions 2.14.0 to 3.14.0 use sudo versions affected by CVE-2021-3156. The affected sudo has a heap-based buffer overflow, allowing privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

VDE-2021-033 — TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities

Thu, 12 Aug 2021 13:02:00 +0000

The TruControl laser control software (versions 1.04 to 3.0.0) uses CODESYS runtime versions affected by multiple CVEs:

**CVE list:**

- CVE-2021-29242 - CVE-2021-29241 - CVE-2019-5105 - CVE-2020-7052 - CVE-2019-9012 - CVE-2019-9010 - CVE-2019-9009 - CVE-2018-10612

In addition to the CVEs listed above, the affected products are also vulnerable to the following issues without a CVE ID:

---

### **CODESYS Advisory 2018-07**

A crafted communication request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.

- **CVSS v3.0 base score:** 6.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12928&token=6d1dcea05a15aeef7ad48eadc64c8eca5d4f07b2&download=)

---

### **CODESYS Advisory 2018-04**

The CODESYS runtime system allows access to files outside the restricted working directory of the controller by online services.

- **CVSS v3.0 base score:** 9.9 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

🔗 [Link to advisory](https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12925&token=50e7240fa947ea215311e3db441f82152f1109b6&download=)

---

### **CODESYS Advisory 2017-03**

A crafted request may cause an access violation in the affected CODESYS products and may result in a denial-of-service condition.

- **CVSS v3.0 base score:** 7.5 - **CVSS v3.0 vector:** `CVSS:3.0/AV:N/AC:L/PR:N/…

VDE-2022-016 — TRUMPF: TruTops Fab, TruTops Boost prone to vulnerability

Mon, 02 May 2022 10:00:00 +0000

A service function in the stated TRUMPF products is exposed without necessary authentication. Execution of this function may result in unauthorized access to, change of data or disruption of the whole service.

VDE-2022-034 — TRUMPF: Products prone to Unified Automation vulnerabilities

Mon, 15 Aug 2022 10:00:00 +0000

A number of TRUMPF software tools use the OPC UA Server in C++ based OPC UA SDK by Unified Automation. The application contains several vulnerabilities, which enable an attacker to send malicious data to the application, resulting in a Denial-of-Service.

VDE-2022-023 — TRUMPF TruTops prone to improper access control

Mon, 17 Oct 2022 10:00:00 +0000

Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

VDE-2022-049 — TRUMPF: Multiple products prone to X.Org server vulnerabilities

Mon, 07 Nov 2022 11:43:00 +0000

TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craft a request which could lead to memory out-of bounds write.

VDE-2023-031 — Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability

Wed, 13 Sep 2023 10:00:00 +0000

The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60b) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes this vulnerability is available.Machines with a running and correctly installed mGuard hardware firewall cannot be exploited by this vulnerability if used as intended (according to the manual).

Update A, 2023-11-13 Removed CVE-2023-4701 because it was revoked.

VDE-2024-003 — TRUMPF: Multiple products include a vulnerable version of Notepad++

Tue, 23 Jan 2024 07:00:00 +0000

The TRUMPF products that are listed above contain a vulnerable version of Notepad++. This version isbeing installed for support purposes only, so there is no danger of triggering this vulnerability inNotepad++ during normal operations. Nevertheless, TRUMPF recommends mitigation of thisvulnerability.When editing a specially crafted file containing UTF-8 characters in Notepad++ (Versions up to 8.5.6) and converting that file to UTF-16, a buffer overflow vulnerability can be exploited that allows an attacker to execute arbitrary code to take over the whole system.

VDE-2024-005 — TRUMPF: Multiple products contain vulnerable version of 7-zip

Tue, 23 Jan 2024 07:00:00 +0000

Under certain circumstances, opening a specially crafted 7-zip package can exploit an integer underflow vulnerability in 7-zip versions up to and including 22.x

This vulnerability allows for a remote code execution, resulting in unauthorized (remote) access to, change of data or disruption of the whole service.