Review - Public ICS Disclosures – Week of 5-2-26 – Part 2

 For Part 2 we have seven additional vendor disclosures from WatchGuard (4) and VEGA (3). There are eight researcher reports of vulnerabilities in products from TP-Link. Finally, we have two exploits for products from PX4 and ThingsBoard. 

Advisories  

WatchGuard Advisory #1 - WatchGuard published an advisory that describes two vulnerabilities in their WatchGuard Agent on Windows product.  

WatchGuard Advisory #2 - WatchGuard published an advisory that describes an incorrect permission assignment for critical resource vulnerability in their WatchGuard Agent on Windows product. 

WatchGuard Advisory #3 - WatchGuard published an advisory that describes a stack-based buffer overflow vulnerability in their WatchGuard Agent Discovery Service on Windows product. 

WatchGuard Advisory #4 - WatchGuard published an advisory that describes a stack-based buffer overflow vulnerability in their WatchGuard Agent Discovery Service on Windows product. 

VEGA Advisory #1 - CERT-VDE published an advisory that describes a missing authentication for critical function vulnerability in the VEGAPULS two- and four-wire products. 

VEGA Advisory #2 - CERT-VDE published an advisory that describes a missing authentication for critical function vulnerability in the VEGAPULS Air products. 

VEGA Advisory #3 - CERT-VDE published an advisory that describes a missing authentication for critical function vulnerability in the VEGAPULS Bluetooth products. 

Researcher Reports  

TP-Link Reports - Cisco Talos published eight reports describing vulnerabilities in the TP-Link Archer AX53 AX3000 Dual Band Gigabit Wi-Fi 6 Router. 

Exploits  

PX4 Exploit - Mohammed Idrees Banyamer published an exploit for a stack-based buffer overflow vulnerability in the PX4‑Autopilot flight controller. 

ThingsBoard Exploit - Tamil Mathi T published an exploit for a Server-side request forgery vulnerability in the ThingsBoard IoT Platform. 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-338 - subscription required.