Haas CNC Controller vulnerabilities

3 known vulnerabilities in Haas CNC Controller from Haas. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Haas CNC Controller: Cleartext Transmission of Sensitive Information

  CVE-2022-41636Oct 28, 2022Haas

  Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This allows an attacker to obtain sensitive information being passed to and from the controller.

• 8.8 High severity

  Haas CNC Controller: Insufficient Granularity of Access Control

  CVE-2022-2475Oct 28, 2022Haas

  Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers outside of the authorized accessible range. This could allow a user to access p

• 8.0 High severity

  Haas CNC Controller: Missing Authentication for Critical Functionality

  CVE-2022-2474Oct 28, 2022Haas

  Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the same network segment as the controller (even while connected remotely) to access the service and write