Review – Six Advisories Published – 5-10-22

Today, CISA’s NCCIC-ICS published six control system security advisories for products from Mitsubishi Electric, AVEVA, Eaton (3), and Adminer.

Mitsubishi Advisory - This advisory discusses two vulnerabilities in the Mitsubishi MELSOFT GT OPC UA Client.

AVEVA Advisory - This advisory describes an exposure of resources to wrong sphere vulnerability in the AVEVA InTouch Access Anywhere and AVEVA Plant SCADA Access Anywhere HMI products.

NOTE: I briefly reported on this vulnerability last Saturday.

Eaton Advisory #1 - This advisory describes a cross-site scripting vulnerability in the Eaton Intelligent Power Manager (IPM).

NOTE: I briefly reported on this vulnerability on March 5^th, 2022.

Eaton Advisory #2 - This advisory describes three vulnerabilities in the Eaton Intelligent Power Manager Infrastructure. This product is EOL.

Eaton Advisory #3 - This advisory describes a cross-site scripting vulnerability in the Eaton Intelligent Power Protector (IPP).

NOTE: I briefly reported on this vulnerability on March 5^th, 2022.

Adminer Advisory - This advisory describes a files or directories accessible to external parties vulnerability (with two known exploits) in Adminer, a PHP SQL database management tool

NOTE: Apparently CISA expects this to be potential third-party vulnerability for multiple control system products. They have started a list of affected products with a link to Advantech’s R-SeeNet product.

 

For more details on these advisories, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/six-advisories-published-5-10-22 - subscription required.