40
CVEs
16
Critical
16
High
0
KEV
3
PoC
30
Unpatched C/H
5.0%
Patch Rate
8.8%
Avg EPSS
Severity Breakdown
CRITICAL
16
HIGH
16
MEDIUM
8
LOW
0
Monthly CVE Trend
Affected Products (30)
Hirschmann Hios
14
Ruggedcom Win7018 Firmware
11
Ruggedcom Win7025 Firmware
11
Vxworks
11
Ruggedcom Win7200 Firmware
11
Windriver
11
Ruggedcom Win7000 Firmware
11
Garrettcom Magnum Dx940E Firmware
11
Sonicos
9
Siprotec 5 Firmware
9
E Series Santricity Os Controller
8
Power Meter 9810 Firmware
7
Power Meter 9410 Firmware
7
Hirschmann Rsb20 0900S2Tttaab
5
Hirschmann Octopus Os3X Xx24Xxx
5
Hirschmann Mach104 16Tx Poep 2X R
5
Hirschmann M1 8Mm Sc
5
Hirschmann Mach104 16Tx Poep R L3P
5
Hirschmann Rsb20 0800T1T1Saab
5
Hirschmann Rsb20 0900Zzz6Saab
5
Hirschmann Mach4002 48G 3X L2P
5
Hirschmann Octopus Os24 081000T5T5Tneuhb
5
Hirschmann Rsb20 0900Zzz6Taab
5
Hirschmann Mach102 24Tp Fr
5
Hirschmann Octopus Os20 000900T5T5Tafbhh
5
Hirschmann M1 8Tp Rj45
5
Hirschmann Mach104 16Tx Poep 2X R L3P
5
Hirschmann Rsb20 0800M2M2Taabe
5
Hirschmann Rsb20 0900Mmm2Taab
5
Hirschmann Mach104 16Tx Poep 2X E L3P
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2019-12255 | Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 75.2% | 69 |
PoC
No patch
|
| CVE-2022-40282 | The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 4.0% | 64 |
PoC
No patch
|
| CVE-2019-12258 | Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 23.4% | 58 |
PoC
No patch
|
| CVE-2017-11402 | An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2017-11401 | An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2018-5469 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.9% | 49 |
No patch
|
| CVE-2019-12256 | Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 26.6% | 49 |
No patch
|
| CVE-2019-12260 | Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 22.8% | 49 |
No patch
|
| CVE-2019-12261 | Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 9.0% | 49 |
No patch
|
| CVE-2019-12262 | Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 4.1% | 49 |
No patch
|
| CVE-2020-6994 | A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.6% | 49 |
No patch
|
| CVE-2021-27734 | Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.3% | 49 |
No patch
|
| CVE-2018-25237 | Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled that allows remote attackers to crash. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.1% | 47 |
No patch
|
| CVE-2017-20234 | GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2018-25236 | Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|