Common Vulnerabilities and Exposures
We are committed to securing critical infrastructure and important products, to make a safer world for everyone
Disclaimer: Some information is redacted for safety, please contact us if you require specific details.
Championing a Safer Digital World
Our Mission
Recognising the significance of transparency in cybersecurity, we understand the paramount importance of informing the public about existing vulnerabilities. In a landscape where undisclosed vulnerabilities could be exploited by malicious actors, causing detrimental impacts on lives and critical infrastructure, our dedication becomes clear.
We have pledged to fortify the security of critical infrastructure and essential products, striving to craft a safer world for all. Through our efforts, we aim not just to protect against immediate threats, but to foster a more secure digital environment where safety and trust prevail.
Ethical Disclosure
Our approach is meticulously designed to minimise risks while maximising digital safety. By proactively contacting companies and relevant authorities, we ensure that vulnerabilities are addressed directly and responsibly.
Name of tester:
Momen
Severity:
Critical
Submission body:
Cybersecurity and Infrastructure Security Agency (CISA)
System type:
SCADA
CVE-2023-4485
CVSS v3 9.8
​Sistema SCADA Central, a supervisory control and data acquisition (SCADA) system, is designed to monitor and control various industrial processes and critical infrastructure. ARDEREG identified this SCADA system’s login page to be vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application’s SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, the vulnerability could allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized access, data leakage, or even disruption of critical industrial processes.
Name of tester:
Momen
Severity:
Critical
Submission body:
Cybersecurity and Infrastructure Security Agency (CISA)
System type:
SCADA
CVE-2023-1934
CVSS v3 9.8
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and passively. Consequently, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data, highlighting the severity of this vulnerability.
Name of tester:
Momen
Severity:
Medium
Submission body:
Cybersecurity and Infrastructure Security Agency (CISA)
System type:
OT
CVE-2023-5885
CVSS v3 6.5
The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users. Successful exploitation of this vulnerability could allow an attacker to obtain login credentials for other users.
Name of tester:
Momen
Severity:
High
Submission body:
Cybersecurity and Infrastructure Security Agency (CISA)
System type:
OT
CVE-2022-44037
CVSS v3 8.8
APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights.
Identifying Vulnerabilities: Our Approach
Our method for uncovering vulnerabilities is multifaceted, blending cutting-edge technology with human insight. Through a combination of drive-by scans and real-world encounters, we actively seek out potential security weaknesses. Our strategy integrates manual testing with human intelligence and the advanced capabilities of AI ecosystems. This allows us to identify and prioritise vulnerabilities that pose the highest risk of exploitation by attackers.
We focus extensively on mapping critical infrastructure systems, and pinpointing vulnerabilities in systems exposed to the internet. Following discovery, we proceed with ethical disclosure, ensuring that these weaknesses are addressed promptly and securely, safeguarding digital integrity and public trust.
Get in touch
Let's find a solution
If you want to chat, give us a call: 0121 740 1304
Or, email us: [email protected]