Allegro
Monthly
Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.
Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This Insufficiently Protected Credentials vulnerability could allow attackers to obtain user credentials due to weak protection mechanisms.
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.
Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This Insufficiently Protected Credentials vulnerability could allow attackers to obtain user credentials due to weak protection mechanisms.
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.