Janitza manufactures electrical energy monitoring and power quality devices, with its vulnerability profile concentrated in the UMG series of industrial power meters and measurement units. The recurring weaknesses affecting these products center on web-application and data-handling issues: sensitive information exposure, improper access control, cross-site request forgery, and cross-site scripting flaws that are characteristic of management interfaces in networked industrial equipment. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Janitza over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-3972HIGH The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access | Oct 28, 2015 | 10.0 | 27 | NO | NO |
CVE-2015-3968HIGH The FTP service on Janitza UMG 508, 509, 511, 604, and 605 devices has a default password, which makes it easier for remote attackers to read or write to files via a session on TCP | Oct 28, 2015 | 7.5 | 25 | NO | NO |
CVE-2023-50894HIGH In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password encryption function allows remote authen | Mar 26, 2024 | 8.8 | 22 | NO | NO |
CVE-2023-50895HIGH In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functionality allow remote authenticated admin | Mar 26, 2024 | 7.2 | 21 | NO | NO |
CVE-2015-3971HIGH The debug interface on Janitza UMG 508, 509, 511, 604, and 605 devices does not require authentication, which allows remote attackers to read or write to files, or execute arbitrar | Oct 28, 2015 | 7.5 | 19 | NO | NO |
CVE-2015-3967MEDIUM Cross-site request forgery (CSRF) vulnerability on Janitza UMG 508, 509, 511, 604, and 605 devices allows remote attackers to hijack the authentication of arbitrary users. | Oct 28, 2015 | 6.8 | 18 | NO | NO |
CVE-2015-3973MEDIUM Janitza UMG 508, 509, 511, 604, and 605 devices improperly generate session tokens, which makes it easier for remote attackers to determine a PIN value via unspecified computations | Oct 28, 2015 | 5.0 | 15 | NO | NO |
CVE-2015-3969MEDIUM Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to obtain sensitive network-connection information via a request to UDP port (1) 1234 or (2) 1235. | Oct 28, 2015 | 5.0 | 15 | NO | NO |
CVE-2015-3970MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Janitza UMG 508, 509, 511, 604, and 605 devices allow remote attackers to inject arbitrary web script or | Oct 28, 2015 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Janitza.
Media articles that mention a CVE ID that affects a product developed by Janitza — matched by CVE ID, not by vendor name.