Csaf
by Cisagov
Source repositories
CVEs (86)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66349 | Med | 0.42 | 6.5 | 0.00 | Jul 30, 2026 | The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing… | ||
| CVE-2026-65421 | Med | 0.42 | 6.5 | 0.00 | Jul 30, 2026 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition. | ||
| CVE-2026-63550 | Med | 0.42 | 6.5 | 0.00 | Jul 30, 2026 | The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position … | ||
| CVE-2026-56758 | Med | 0.42 | 6.5 | 0.00 | Jul 30, 2026 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer. | ||
| CVE-2026-44622 | Med | 0.42 | 6.5 | 0.00 | Jun 25, 2026 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. | ||
| CVE-2026-52866 | Med | 0.42 | 6.5 | 0.00 | Jun 19, 2026 | An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection. | ||
| CVE-2026-50034 | Med | 0.42 | 6.5 | 0.00 | Jun 19, 2026 | An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values. | ||
| CVE-2025-12636 | Med | 0.42 | 6.5 | 0.00 | Nov 6, 2025 | The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of… | ||
| CVE-2026-21404 | Med | 0.41 | 6.3 | 0.00 | Jun 4, 2026 | NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful… | ||
| CVE-2026-35555 | Med | 0.41 | 6.3 | 0.00 | May 12, 2026 | PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups. | ||
| CVE-2025-12357 | Med | 0.41 | 6.3 | 0.00 | Oct 31, 2025 | By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable … | ||
| CVE-2026-57896 | Med | 0.40 | 6.1 | 0.00 | Jul 16, 2026 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product. | ||
| CVE-2025-67652 | Med | 0.40 | 6.1 | 0.00 | Jan 22, 2026 | An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type… | ||
| CVE-2025-25051 | Med | 0.40 | 6.1 | 0.00 | Jan 22, 2026 | An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks. | ||
| CVE-2026-40425 | Med | 0.37 | 5.7 | 0.00 | May 29, 2026 | The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password. | ||
| CVE-2026-33570 | Med | 0.37 | 5.7 | 0.00 | May 12, 2026 | PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions. | ||
| CVE-2026-26049 | Med | 0.37 | 5.7 | 0.00 | Feb 20, 2026 | The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, … | ||
| CVE-2026-61378 | Med | 0.36 | 5.5 | 0.00 | Jul 16, 2026 | A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash. | ||
| CVE-2026-6807 | Med | 0.36 | 5.5 | 0.00 | Apr 28, 2026 | A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process. | ||
| CVE-2026-44611 | Med | 0.35 | 5.4 | 0.00 | May 29, 2026 | Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks. |
- risk 0.42cvss 6.5epss 0.00
The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing…
- risk 0.42cvss 6.5epss 0.00
The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition.
- risk 0.42cvss 6.5epss 0.00
The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position …
- risk 0.42cvss 6.5epss 0.00
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer.
- risk 0.42cvss 6.5epss 0.00
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
- risk 0.42cvss 6.5epss 0.00
An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection.
- risk 0.42cvss 6.5epss 0.00
An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values.
- risk 0.42cvss 6.5epss 0.00
The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of…
- risk 0.41cvss 6.3epss 0.00
NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful…
- risk 0.41cvss 6.3epss 0.00
PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
- risk 0.41cvss 6.3epss 0.00
By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable …
- risk 0.40cvss 6.1epss 0.00
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.
- risk 0.40cvss 6.1epss 0.00
An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type…
- risk 0.40cvss 6.1epss 0.00
An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks.
- risk 0.37cvss 5.7epss 0.00
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
- risk 0.37cvss 5.7epss 0.00
PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.
- risk 0.37cvss 5.7epss 0.00
The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, …
- risk 0.36cvss 5.5epss 0.00
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.
- risk 0.36cvss 5.5epss 0.00
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
- risk 0.35cvss 5.4epss 0.00
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
Page 4 of 5