EY-modulo 5 ecos 5 ecos504/505 vulnerabilities
4 known vulnerabilities in EY-modulo 5 ecos 5 ecos504/505 from Sauter. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
modulo 6 devices modu680-AS: Failure to Handle Incomplete Element
An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.
- 9.8 Critical severity
modulo 6 devices modu680-AS: Path Traversal: '.../...//'
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.
- 7.5 High severity
modulo 6 devices modu680-AS: Use of Hard-coded Credentials
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.
- 8.8 High severity
modulo 6 devices modu680-AS: Improper Validation of Syntactic Correctness of Input
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default