ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Keywords match titles. Record type separates incidents, intel, and research from CVEs.

  1. Research · Dec 5, 2023 · ZeroDay Catalog

    Insecure Default Password Vulnerability in Unitronics Vision PLC and HMI

    A critical vulnerability has been identified in Unitronics Vision PLC and HMI systems, allowing unauthorized access due to insecure default passwords.

    What changed

    Unitronics has reported a significant security vulnerability affecting its Vision PLC and HMI products. The issue arises from the use of an insecure default administrative password in VisiLogic versions prior to 9.9.00.

    This vulnerability enables unauthenticated attackers with network access to gain administrative control over affected systems, posing a serious risk to operational integrity.

    Who is affected

    Organizations utilizing Unitronics Vision PLCs and HMIs, particularly those running VisiLogic versions earlier than 9.9.00, are at risk.

    This includes manufacturing facilities, automation systems, and any infrastructure relying on these devices for operational control.

    • Unitronics Vision PLCs
    • Unitronics Vision HMIs
    • Manufacturing and automation sectors
    • Organizations using VisiLogic software

    What to do

    It is imperative for affected organizations to update their VisiLogic software to version 9.9.00 or later to mitigate this vulnerability.

    Additionally, organizations should review their security policies regarding default passwords and implement measures to enforce strong password practices.

    • Upgrade VisiLogic to version 9.9.00 or higher.
    • Change default passwords immediately on all devices.
    • Implement network segmentation to limit access to PLCs and HMIs.
    • Regularly audit and monitor access to critical systems.

    Original report

  2. Research · Nov 30, 2023 · ZeroDay Catalog

    Critical Memory Corruption Vulnerability in Apple WebKit

    A memory corruption vulnerability in Apple’s WebKit could allow for code execution through malicious web content, impacting multiple products.

    What changed

    Apple has identified a memory corruption vulnerability within WebKit that affects several of its products. This flaw can lead to arbitrary code execution when users interact with specially crafted web content.

    The vulnerability underscores the importance of addressing potential security risks associated with web browsing and HTML content processing.

    Who is affected

    The vulnerability affects a range of Apple products, as well as other applications that utilize WebKit for HTML processing.

    Organizations using affected products should be aware of the potential risks and take necessary precautions.

    • Apple iOS devices
    • Apple iPadOS devices
    • Apple macOS systems
    • Apple Safari browser

    What to do

    Users and administrators are advised to apply the latest updates from Apple to mitigate the risks associated with this vulnerability.

    Regular monitoring of security advisories and prompt patching of affected systems is essential to maintain security.

    • Update all Apple devices to the latest software version.
    • Review and apply security patches for any non-Apple products that utilize WebKit.
    • Educate users about the risks of interacting with untrusted web content.

    Original report