Review – Public ICS Disclosures – Week of 12-9-23 – Part 2

For Part 2 we have nine additional vendor disclosures for products from Phoenix Contact (6), Schneider (2), and VMware. There are 18 vendor updates from Mitsubishi, Schneider, Siemens (15), and Sierra Wireless. We also have seven researcher reports for vulnerabilities in products from EisBaer, Finally, we have two exploits for products from Atos and Splunk.

Advisories

Phoenix Contact Advisory #1 - Phoenix Contact published an advisory that describes an incorrect permissions assignment for a critical resource vulnerability in their MULTIPROG Engineering tool and ProConOS eCLR SDK.

Phoenix Contact Advisory #2 - Phoenix Contact published an advisory that describes an incorrect permissions assignment for a critical resource vulnerability in their Automation Worx Software Suite and classic line industrial controllers.

Phoenix Contact Advisory #3 - Phoenix Contact published an advisory that describes an incorrect permissions assignment for a critical resource vulnerability in their PLCnext Control.

Phoenix Contact Advisory #4 - Phoenix Contact published an advisory that describes a download of code without integrity check vulnerability in their MULTIPROG Engineering tool and ProConOS eCLR SDK.

Phoenix Contact Advisory #5 - Phoenix Contact published an advisory that describes a download of code without integrity check vulnerability in their Automation Worx Software Suite and classic line industrial controllers.

Phoenix Contact Advisory #6 - Phoenix Contact published an advisory that describes a download of code without integrity check vulnerability in their PLCnext Control.

Schneider Advisory #1 - Schneider published an advisory that discusses a missing authorization vulnerability (that is listed in CISA’s Known Exploited Vulnerabilities Catalog) in their Plant iT/Brewmaxx product.

Schneider Advisory #2 - Schneider published an advisory that describes two vulnerabilities in their Trio License-Free Radio products.

VMware Advisory - VMware published an advisory that describes a privilege escalation vulnerability in their Workspace ONE Launcher.

Updates

Mitsubishi Update - Mitsubishi published an update for their FA Engineering Software advisory that was originally published on November 24^th, 2022 and most recently updated on June 29^th, 2023.

Schneider Update - Schneider published an update for their PowerLogic advisory that was originally published on November 14^th, 2023.

Siemens Update #1 - Siemens published an update for their TIA Portal advisory that was originally published on June 13^th, 2023.

Siemens Update #2 - Siemens published an update for their LOGO! Soft Comfort advisory that was originally published on April 13^th, 2023.

Siemens Update #3 - Siemens published an update for their LOGO! 8 BM Devices advisory that was originally published on October 11^th, 2023.

Siemens Update #4 - Siemens published an update for their SIMATIC S7-1500 TM MFP V1.0 advisory that was originally published on June 13^th, 2023 and most recently updated on November 14^th, 2023.

Siemens Update #5 - Siemens published an update for their SIMATIC S7-1500 TM MFP V1.0 advisory that was originally published on June 13^th, 2023 and most recently updated on November 14^th, 2023.

Siemens Update #6 - Siemens published an update for their LOGO! 8 BM advisory that was originally published on March 9^th, 2021.

Siemens Update #7 - Siemens published an update for their OPC UA Implementations of SIMATIC Products advisory that was originally published on September 12^th, 2023 and most recently updated on October 10^th, 2023.

Siemens Update #8 - Siemens published an update for their n SCALANCE XB-200 advisory that was originally published on November 14^th, 2023.

Siemens Update #9 - Siemens published an update for their Boot Loader of RUGGEDCOM ROS Devices advisory that was originally published on December 10^th, 2019 and most recently updated on September 13^th, 2022.

Siemens Update #10 - Siemens published an update for their S7-1500 CPU devices advisory that was originally published on January 10^th, 2023 and most recently updated on March 14^th, 2023.

Siemens Update #11 - Siemens published an update for their GNU/Linux subsystem of the SIMATIC S7-1500 advisory that was originally published on November 27^th, 2018, and most recently updated on November 14^th, 2023.

Siemens Update #12 - Siemens published an update for their OpenSSL X.400 Address Processing in SIMATIC Products advisory that was originally published on August 8^th, 2023 and most recently updated on September 12^th, 2023.

Siemens Update #13 - Siemens published an update for their OpenSSL RSA Decryption in SIMATIC Products that was originally published on August 8^th, 2023 and most recently updated on November 14^th, 2023.

Siemens Update #14 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on March 8^th, 2022 and most recently updated on April 11^th, 2023.

Siemens Update #15 - Siemens published an update for their WIBU Vulnerability in Industrial Products advisory that was originally published on September 12^th, 2023 and most recently updated on October 10^th, 2023.

Sierra Wireless Update - Sierra Wireless published an update to their ALEOS Security Advisory that was originally published on November 28^th, 2023 and most recently updated on December 7^th, 2023.

Researcher Reports

EisBaer Researcher Report - Claroty Team88 published seven reports on individual vulnerabilities in the EisBaer Scada.

Exploits

Atos Exploit - Armin Weihbold published an exploit for an argument injection vulnerability in the Atos Unify OpenScape Session Border Controller.

Splunk Exploit - Valentin Lobstein published a Metasploit module for an XML injection vulnerability in the Splunk Enterprise product.

 

For more details about these disclosures, including a brief description of changes made in updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-5a1 - subscription required. 

Review – Public ICS Disclosures – Week of 12-2-23

This week we have 37 vendor disclosures from CODESYS, Dell (2), HP, HPE, Insyde, Pilz (3), QNAP (3), SEL (2), Siemens, Tanzu (20), and Wago (2). There are three vendor updates from Atos, CODESYS, and Dell. We have two researcher reports for vulnerabilities in products from Atos and R Radio Network. Finally, we have two exploits for products from FortiGuard and Orpak.

Advisories

CODESYS Advisory - CODESYS published an advisory that describes an OS command injection vulnerability in their Control runtimes running on Linux or QNX operating systems.

Dell Advisory #1 - Dell published an advisory that discusses an out-of-bounds write vulnerability in the ThisOS.

Dell Advisory #2 - Dell published an advisory that discusses 28 vulnerabilities in their Dell Wyse Management Suite.

HP Advisory - HP published an advisory that discusses an improper input validation vulnerability in multiple notebook and desktop computers.

HPE Advisory - HPE published an advisory that describes an information disclosure vulnerability in their HP-UX System Management Homepage.

Insyde Advisory - Insyde published an advisory that discusses an improper input validation vulnerability in multiple kernels

Pilz Advisory #1 - CERT-VDE published an advisory that discusses two vulnerabilities in the Pilz PASvisu and PMI products.

Pilz Advisory #2 - CERT-VDE published an advisory that discusses an out-of-bounds write vulnerability in the Pilz PASvisu, PIT Transponder Manager, and PMI products.

Pilz Advisory #3 - Pilz published an advisory that discusses vulnerabilities in multiple products.

QNAP Advisory #1 - QNAP published an advisory that describes a cross-site scripting vulnerability in their QTS and QuTS hero products.

QNAP Advisory #2 - QNAP published an advisory that describes an OS command injection vulnerability in their legacy VioStor NVR product.

QNAP Advisory #3 - QNAP published an advisory that describes two classic buffer overflow vulnerabilities in their QTS and QuTS hero products.

QNAP Advisory #4 - QNAP published an advisory that discusses five vulnerabilities in their QTS and QuTS hero products.

SEL Advisories - SEL announced new versions of two products that address cybersecurity issues.

Siemens Advisory - Siemens discussed a Black Hat Europe presentation describing the details of the legacy PG/PC and HMI communication protocol as used between TIA Portal / HMIs and SIMATIC S7-1500 SW Controller in versions before V17.

Tanzu Advisories - Tanzu published 20 advisories discussing third-party vulnerabilities in various Tanzu products.

Wago Advisory #1 - CERT-VDE published an advisory that describes an observable discrepancy vulnerability in the Wago Smart Designer product.

Wago Advisory #2 - CERT-VDE published an advisory that describes an improper input validation vulnerability in the Wago Telecontrol Configurator and WagoAppRTU products.

Updates

Atos Update - Atos published an update for their Unify OpenScape advisory that was originally published on October 4^th, 2023 and most recently updated on September 10^th, 2023.

CODESYS Update - CODESYS published an update for their WIBU CodeMeter Runtime advisory that was originally published on August 17^th, 2023 and most recently updated on October 31^st, 2023.

Dell Update - Dell published an update for their Rugged Control Center advisory that was originally published on November 30^th, 2023.

Researcher Reports

Atos Report - SEC Consult published a report that describes an argument injection vulnerability in the Atos Unify OpenScape products.

R Radio Network Report - Zero Science published a report describing two vulnerabilities in the R Radio Network.

Exploits

FortiGuard Exploit - Cody Sixteen published an exploit for a post authentication CLI crash vulnerability in the FortiWeb VM product.

Orpak Exploit - Parsa Rezaei Khiabanloo published an exploit for a default password vulnerability in the Orpak fueling systems.

 

For more details about these disclosures, including links to researcher reports, 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-66a - subscription required.

Review – Public ICS Disclosures – Week of 9-16-23

This week we have 15 vendor disclosures from Fauscher, GE Gas Power, HPE (4), Ingeteam, Mitsubishi, Phoenix Contact, QNAP (3), Schweitzer Engineering Labs (2), and Zyxel. There are five vendor updates for products from Broadcom (2) and Palo Alto Networks (3). There are also two researcher reports for products from Atos and Royal Aps. Finally, we have an exploit for products from Ivanti.

Advisories

Frauscher Advisory – CERT-VDE published an advisory that describes three vulnerabilities in their FDS101 for FAdC/FAdCi product.

GE Advisory - GE published an advisory that discusses seven vulnerabilities in the Nozomi Guardian/CMC.

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities in their NonStop Products.

HPE Advisory #2 - HPE published an advisory that describes four incomplete cleanup vulnerabilities in their NonStop Products.

HPE Advisory #3 - HPE published an advisory that discusses two improper initialization vulnerabilities in their ProLiant AMD XL Servers.

HPE Advisory #4 - HPE published an advisory that discusses two improper initialization vulnerabilities in their ProLiant AMD DL Servers.

Ingeteam Advisory - Incibe-CERT published an advisory that describes three input validation vulnerabilities in the Ingeteam INGEPAC DA3451 and INGEPAC FC5066.

Mitsubishi Advisory - Mitsubishi published an advisory that describes an incorrect default permissions vulnerability in their FA Engineering Software products.

QNAP Advisory #1 - QNAP published an advisory that describes a classic buffer overflow vulnerability in their Multimedia Console products.

QNAP Advisory #2 - QNAP published an advisory that describes a classic buffer overflow vulnerability in their legacy versions of QTS products.

QNAP Advisory #3 - QNAP published an advisory that discusses three vulnerabilities in their QTS, QuTS hero, and QuTScloud.

SEL Advisory #1 - SEL published an advisory that reports vulnerabilities in their Protocol Services.

SEL Advisory #2 - SEL published an advisory that reports vulnerabilities in their Blueframe OS.

Zyxel Advisory - Zyxel published an advisory that discusses the report of a 2017 vulnerability in their EMG2926-Q10A product being listed on  CISA Known Exploited Vulnerabilities (KEV) catalog.

Updates

Broadcom Update #1 - Broadcom published an update for their Apache HTTP Server advisory that was originally published on August 1^st, 2023.

Broadcom Update #2 - Broadcom published an update for their HTTP Server advisory that was originally published on August 1^st, 2023.

Palo Alto Networks Update #1 - Palo Alto Networks published an update for their TunnelCrack vulnerabilities advisory that was originally published on August 16^th, 2023 and most recently updated on August 21^st.

Palo Alto Networks Update #2 - Palo Alto Networks published an update for their Cortex XDR Agent advisory that was published on September 9^th.

Palo Alto Networks Update #3 - Palo Alto Networks published an update for their BGP Software advisory that was published on September 13^th, 2023.

Reports

Atos Report - SEC Consult published a report describing two vulnerabilities in the Atos Unify OpenScape. The report includes proof-of-concept code.

Royal Aps Report - Zero Science published a report that describes a heap memory corruption vulnerability in the Royal Apps RoyalTSX remote access tool.

Exploit

Ivanti Exploit - Ege Balci published a Metasploit module for an out-of-bounds write vulnerability in the Ivanti Avalanche MDM.

 

For more details about these disclosures, including links to 3^rd party advisories and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-53a - subscription required.