Ifm CVEs and Security Vulnerabilities

CVE-2024-28749

ifm: Writing file function in Smart PLC allows command injections

A remote attacker with high privileges may use a writing file function to inject OS commands.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ifm

Products

Smart Plc Ac14xx Firmware Smart Plc Ac4xxs Firmware

CVE-2024-28747

ifm: Use of Hard-coded Credentials

An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ifm

Products

Smart Plc Ac14xx Firmware Smart Plc Ac4xxs Firmware

CVE-2024-28748

ifm: Reading function in Smart PLC allows command injections

A remote attacker with high privileges may use a reading file function to inject OS commands.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ifm

Products

Smart Plc Ac14xx Firmware Smart Plc Ac4xxs Firmware

CVE-2024-5404

ifm: moneo prone to weak password recovery mechanism

An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ifm

Products

Moneo For Microsoft Windows Moneo Qha210 Moneo Qha300 and 1 more

CVE-2024-28750

ifm: Deleting function in Smart PLC allows command injections

A remote attacker with high privileges may use a deleting file function to inject OS commands.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ifm

Products

Smart Plc Ac14xx Firmware Smart Plc Ac4xxs Firmware

CVE-2024-28751

ifm: Hardcoded telnet credentials in Smart PLC

An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Ifm

Products

Smart Plc Ac14xx Firmware Smart Plc Ac4xxs Firmware

CVE-2022-3485

Weak Password Recovery in ifm moneo appliance

In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ifm

Products

Moneo Qha200 Moneo Qha200 Firmware Moneo Qha210 and 1 more

Search vulnerabilities

ifm: Writing file function in Smart PLC allows command injections

ifm: Use of Hard-coded Credentials

ifm: Reading function in Smart PLC allows command injections

ifm: moneo prone to weak password recovery mechanism

ifm: Deleting function in Smart PLC allows command injections

ifm: Hardcoded telnet credentials in Smart PLC

Weak Password Recovery in ifm moneo appliance