Vulnerabilities

Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files.

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services.

Horner Automation Cscape version 10.0 (10.0.415.2) SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to disclose information and execute arbitrary code on affected installations of Csc…

The vulnerability occurs in the parsing of CSP files.

Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code.

In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which would result in execution of arbitrary code on affected install…

The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).

The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT).

The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).

The affected product does not properly validate user-supplied data.

Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI).

Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI).

The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).

The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP).

Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI).

The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).

Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e.

Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e.

Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e.

Horner Automation’s RCC 972 firmware version 15.40 contains global variables.

The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering.

Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device.

Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data.

Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data.

Horner Automation's Cscape version 9.90 SP7 and prior does not properly validate user-supplied data.