Plan ahead High Patch available
Welotec SMART EMS PHP flaws allow remote code execution without login
CERT@VDE advisoriesWelotec
What happened. Two memory-safety flaws in the PHP runtime bundled with SMART EMS let an unauthenticated remote attacker run arbitrary code in the PHP web worker. Exploitability depends on server interface, configuration and worker reuse.
Who is affected. Users of Welotec SMART EMS up to and including v3.5.3.
What to do. Check whether you run Welotec SMART EMS v3.5.3 or earlier, and apply the vendor's fix or guidance in advisory VDE-2026-127.
When to act. Plan ahead: judged high and no score stated: check the vendor advisory
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3.5
- L3
Why: SMART EMS is a web-based management product; the report does not state its level, so site operations and the industrial DMZ are the closest fit.
- Are you exposed?
Search the asset inventory for Welotec SMART EMS at v3.5.3 or earlier and check whether its web interface is reachable from other networks.
- If you cannot fix it yet
- Block access to the SMART EMS web interface from untrusted networks and allow only known management hosts.
- Place SMART EMS behind a firewall or reverse proxy that limits who can reach the PHP web service.
- Watch for
- Unexpected requests to the SMART EMS web interface from unknown sources.
- Unusual processes or outbound connections started by the PHP web worker on the SMART EMS host.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CERT@VDE advisories (opens certvde.com)
More on Welotec