Review - Public ICS Disclosure – Week of 1-8-22 – Part 2

For Part 2 we have 7 vendor disclosures from Schneider Electric. There are also seven updates from Schneider and Siemens (6).

Schneider Advisory #1 - Schneider published an advisory describing two vulnerabilities in their Modicon M340 controller and Communication Modules.

Schneider Advisory #2 - Schneider published an advisory describing a buffer copy without checking size of input vulnerability in their Easergy T300 RTU.

Schneider Advisory #3 - Schneider published an advisory describing two vulnerabilities in their Easergy P5 product line.

Schneider Advisory #4 - Schneider published an advisory describing a buffer copy without checking size of input vulnerability in their Easergy P3 products.

Schneider Advisory #5 - Schneider published an advisory describing six vulnerabilities in their ConneXium Tofino Firewall products.

Schneider Advisory #6 - Schneider published an advisory discussing 10 vulnerabilities in various Schneider products based upon CODESYS products.

Schneider Advisory #7 - Schneider published an advisory describing four vulnerabilities in their EcoStruxure™ Power Monitoring Expert product.

Schneider Update - Schneider published an update for their BadAlloc advisory that was originally published on November 9^th, 2021 and most recently updated on December 15^th, 2021.

Siemens Update #1 - Siemens published an update for their NAME:WRECK advisory that was originally published on April 13^th, 2021 and most recently updated on November 9^th, 2021.

NOTE: NCCIC-ICS did not update their advisory (ICSA-21-103-04) to reflect this change.

Siemens Update #2 - Siemens published an update for their WIBU CodeMeter advisory that was originally published on November 9^th, 2021 an most recently updated on December 14^th, 2021.

Siemens Update #3 - Siemens published an update for their NAME:WRECK advisory that was originally published on April 13^th, 2021 and most recently updated on November 9^th, 2021.

Siemens Update #4 - Siemens published an update for their NAME:WRECK advisory that was originally published on April 13^th, 2021 and most recently updated on November 9^th, 2021

NOTE: NCCIC-ICS did not update their advisory (ICSA-21-287-09) to reflect this change.

Siemens Update #5 - Siemens published an update for their OpenSSL advisory that was originally reported on July 13^th, 2021 and most recently updated on December 14th, 2021.

Siemens Update #6 - Siemens published an update for their INFRA:HALT advisory that was originally published on August 4^th, 2021 and most recently updated on September 14^th, 2021.

For more details on these advisories and updates, including links to 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-1-8-503 - subscription required.