ZeroDay Findings
Sign inSign up

Every 24 hours

Tech

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

Filter by vulnerability, fix, incident, intel, or research.

  1. Research · Dec 5, 2023

    Critical Insecure Default Password Vulnerability in Unitronics Vision PLC and HMI

    A significant vulnerability has been identified in Unitronics Vision PLC and HMI systems, allowing unauthorized access due to insecure default passwords.

    What changed

    Unitronics Vision PLC and HMI systems have been found to have a serious security flaw related to the use of an insecure default administrative password. This vulnerability affects versions of VisiLogic prior to 9.9.00.

    An unauthenticated attacker with network access can exploit this weakness to gain administrative control over the affected systems, posing a significant risk to operational integrity.

    Who is affected

    The vulnerability impacts a range of products and systems, particularly those utilizing the Vision and Samba PLCs and HMIs.

    Organizations using Unitronics Vision PLCs and HMIs should be aware that their systems may be at risk if they have not updated to the latest firmware.

    • Unitronics Vision PLCs
    • Unitronics Samba PLCs
    • Unitronics HMIs
    • Users of VisiLogic software versions before 9.9.00

    What to do

    It is crucial for users of affected systems to take immediate action to mitigate the risks associated with this vulnerability. Updating to the latest version of VisiLogic is highly recommended.

    Additionally, users should review their security policies to ensure that default passwords are changed and that robust password management practices are implemented.

    • Upgrade VisiLogic to version 9.9.00 or later.
    • Change default passwords on all devices.
    • Implement network security measures to restrict unauthorized access.
    • Regularly audit and update security protocols.

  2. Research · Dec 4, 2023

    Critical Use-After-Free Vulnerability Discovered in Qualcomm Chipsets

    A significant use-after-free vulnerability has been identified in multiple Qualcomm chipsets, posing potential risks to devices utilizing these components.

    What changed

    Recent findings have uncovered a use-after-free vulnerability affecting several Qualcomm chipsets. This issue arises from memory corruption within DSP Services when a remote call is made from the High-Level Operating System (HLOS) to the Digital Signal Processor (DSP).

    Such vulnerabilities can lead to severe security risks, including unauthorized access and potential exploitation by malicious actors.

    Who is affected

    The vulnerability impacts a range of Qualcomm products, particularly those utilizing specific chipsets. This includes devices that rely on the 315 5G IoT modem firmware.

    As a result, manufacturers and users of these devices should be aware of the potential risks associated with this vulnerability.

    • Qualcomm 315 5G IoT modem firmware
    • Various IoT devices utilizing Qualcomm chipsets
    • Manufacturers of smartphones and connected devices using affected chipsets
    • Service providers relying on Qualcomm technology for network infrastructure

    What to do

    Users and manufacturers are advised to monitor for updates from Qualcomm regarding security patches that address this vulnerability. Implementing these updates promptly can mitigate the associated risks.

    Additionally, organizations should conduct risk assessments to evaluate the potential impact of this vulnerability on their systems.