Trex Mes
Monthly
Unauthenticated SQL injection in Trex MES (all versions through 2026-09-29) lets a remote attacker reach the application over the network and inject arbitrary SQL into backend database queries, with the reported impact escalating to execution of operating-system commands. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any network-reachable instance of the MES web interface is directly in scope; the practical exposure limit is that this is niche manufacturing-execution software typically deployed on internal or OT-adjacent networks rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor patch version is specified in the available intelligence, so defenders should treat network isolation of the MES interface as the primary risk control while awaiting vendor guidance.
Authentication bypass in Trex MES allows unauthenticated attackers positioned on the same adjacent network segment to invoke a critical function without supplying credentials, delivering full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is limited to attackers who can reach the MES host over the local or OT network - the flaw is not reachable from the public internet - but no privileges or user interaction are required and attack complexity is low, so any host on that segment can trigger it against affected builds through 2026-09-29. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure depends almost entirely on how tightly the MES network is segmented.
Unauthenticated SQL injection in Trex MES (all versions through 2026-09-29) lets a remote attacker reach the application over the network and inject arbitrary SQL into backend database queries, with the reported impact escalating to execution of operating-system commands. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any network-reachable instance of the MES web interface is directly in scope; the practical exposure limit is that this is niche manufacturing-execution software typically deployed on internal or OT-adjacent networks rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor patch version is specified in the available intelligence, so defenders should treat network isolation of the MES interface as the primary risk control while awaiting vendor guidance.
Authentication bypass in Trex MES allows unauthenticated attackers positioned on the same adjacent network segment to invoke a critical function without supplying credentials, delivering full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is limited to attackers who can reach the MES host over the local or OT network - the flaw is not reachable from the public internet - but no privileges or user interaction are required and attack complexity is low, so any host on that segment can trigger it against affected builds through 2026-09-29. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure depends almost entirely on how tightly the MES network is segmented.