Review – Public ICS Disclosures – Week of 12-24-22

This week we have seven vendor disclosures from ABB, BD, Broadcom, Fuji Electric (2), Hitachi, and QNAP. Finally, we have a vendor update from Mitsubishi Electric.

Vendor Advisories

ABB Advisory - ABB published an advisory that describes two vulnerabilities in their NE843 Pulsar Plus Controller.

BD Advisory - BD published an advisory discussing an improper authentication vulnerability (with known exploit) in their Alaris products.

Broadcom Advisory - Broadcom published an advisory that discusses five Linux Kernel (ksmb module) vulnerabilities.

Fuji Advisory #1 - JP CERT published an advisory that describes three vulnerabilities in the Fuji V-Server.

Fuji Advisory #2 - JP CERT published an advisory that describes two vulnerabilities in the Fuji Electric V-SFT and TELLUS products.

Hitachi Advisory - Hitachi published an advisory that discusses 27 vulnerabilities in their Disk Array Systems.

QNAP Advisory - QNAP published an advisory that discusses that discusses one of the five recent Linux Kernel (ksmb module) vulnerabilities.

Vendor Updates

Mitsubishi Update - Mitsubishi published an update for their GENESIS64 advisory that was originally published on December 13^th, 2022.

NOTE: NCCIC-ICS has not updated their advisory (ICSA-22-347-01) for this information.

 

For more details about these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-388 - subscription required.