Review – 3 Advisories and 1 Update Published – 8-22-23

Today, CISA’s NCCIC-ICS published three control system security advisories for products from Rockwell Automation, Trane, and Hitachi Energy. They also updated an advisory for products from Mitsubishi.

Advisories

Rockwell Advisory - This advisory describes three improper input validation vulnerabilities in the Rockwell ThinManager ThinServer.

Trane Advisory - This advisory describes a command injection vulnerability in the Trane and Pivot thermostats.

Hitachi Energy Advisory - This advisory discusses six vulnerabilities in the Hitachi Energy AFF66x Products.

Updates

Mitsubishi Update - This update provides additional information on an advisory that was originally published on May 18^th, 2023.

 

For more details about these advisories, including links to 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-1-update-published-cce - subscription required.