Review – Public ICS Disclosures – Week of 5-14-22

This week we have sixteen vendor disclosures from Aruba, Fujitsu, HPE (6), Moxa, OPC Foundation, Pepperl+Fuchs, Philips, Sick, Siemens, Tanzu (2). Then we have two vendor updates from Aruba and Johnson Controls. Finally, we have four researcher reports for products from Schneider, Spectrum Brands, Tesla, and Galleon.

Aruba Advisory - Aruba published an advisory that discusses five vulnerabilities in multiple Aruba products.

Fujitsu Advisory - JP-CERT published an advisory that discusses two vulnerabilities in the Fujitsu IPCOM products.

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities in their Edgeline Servers.

HPE Advisory #2 - HPE published an advisory that discusses an information disclosure vulnerability in their Moonshot/Edgeline Servers.

HPE Advisory #3 - HPE published an advisory that discusses an information disclosure vulnerability in their Moonshot/Edgeline Servers.

HPE Advisory #4 - HPE published an advisory that discusses six vulnerabilities in their HP-UX OpenSSL products.

HPE Advisory #5 - HPE published an advisory that describes three vulnerabilities in their OneView product.

HPE Advisory #6 - HPE published an advisory that discusses 14 vulnerabilities in their ProLiant Gen10 and Gen10 Plus Servers.

Moxa Advisory - Moxa published an advisory that discusses a heap-based buffer overflow vulnerability in the Linux IPsec ESP transformation code.

OPC Advisory - The OPC Foundation published an advisory that describes an uncontrolled resource exhaustion vulnerability in their UA Legacy Java Stack.

NOTE: I believe that this vulnerability was one of the ones reported in the Pwn2Own Miami 2022 competition that I briefly mentioned last week.

Pepperl+Fuchs Advisory - CERT-VDE published an advisory that discusses six Bluetooth vulnerabilities in the Pepperl+Fuchs RSM-EX01B product family.

Philips Advisory - Philips published an advisory that discusses the CISA Emergency Directive 22-03 for the mitigation of VMware vulnerabilities.

Sick Advisory - Sick published an advisory that describes a deserialization of untrusted data vulnerability in their Flexi Soft Designer & Safety Designer.

Siemens Report - Siemens published a report discussing a published exploit of their S7-1200 4.5 that was published back in March.

Tanzu Advisory #1 - Tanzu published an advisory that describes an integer overflow vulnerability in their Spring Security product.

Tanzu Advisory #2 - Tanzu published an advisory that describes an authorization bypass vulnerability in their Spring Security product.

Aruba Update - Aruba published an update for their TLStorm 2.0 advisory that was originally published on May 3^rd, 2022.

Johnson Controls Update - Johnson Controls published an update for their SpringShell advisory that was that was originally published on April 19^th, 2022 and most recently updated on April 29^th, 2022.

Schneider Report #1 - Kaspersky published a report that describes an authentication bypass by spoofing vulnerability in the Schneider Electric Modicon M340/M580 controllers.

Schneider Report #2 - Kaspersky published a report that describes an information leak from project files vulnerability in the Schneider Electric EcoStruxure Control Expert / Process Expert, and SCADAPack RemoteConnect products.

Spectrum Brands Report - NCC Group published a report describing a BLE relay vulnerability in the Kwikset/Weiser Kevo smart locks.

Tesla Report - NCC Group published a report describing a BLE relay vulnerability in the Tesla automobile.

Galleon Report - Pen Test Partners published a report describing a command injection vulnerability in the Galleon Systems’ GPS NTP time server.

For more details on these disclosures, including links to researcher reports and third-party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-581 - subscription required.