Review – 11 Advisories and 2 Updates Published – 5-20-25

Today CISA’s NCCIC-ICS published 11 control system security advisories for products from Assured Telematics, Vertiv, AutomationDirect, Schneider (3), Siemens, Mitsubishi, Danfoss, NI, ABUP. They also updated two advisories for products from Schneider.

Advisories

Assured Telematics Advisory - This advisory describes an exposure of sensitive information to an unauthorized control sphere vulnerability in the Assured Telematics Fleet Management System.

Vertiv Advisory - This advisory describes two vulnerabilities in the Vertiv Liebert RDU101 and Liebert UNITY communications cards.

Automation Direct Advisory - This advisory describes a missing authentication for critical function vulnerability in the AutomationDirect MB-Gateway.

Schneider Advisory #1 - This advisory describes an externally controlled reference to a resource in another sphere vulnerability in the Schneider Modicon Controllers M241/M251/M258/LMC058.

Schneider Advisory #2 - This advisory discusses a missing authentication for critical function vulnerability in the Schneider Galaxy VS, VL, and VXL products.

Schneider Advisory #3 - This advisory discusses a classic buffer overflow vulnerability in the Schneider PrismaSeT Active wireless panel server.

Siemens Advisory - This advisory discusses a missing encryption of sensitive data vulnerability in the Siemens Siveillance Video product.

Mitsubishi Advisory - This advisory describes an execution with unnecessary privileged vulnerability in the Mitsubishi MC Works64 AlarmWorX Multimedia and the Iconics GENESIS64 AlarmWorX Multimedia products.

Danfoss Advisory - This advisory describes an improper authentication vulnerability in the Danfoss K-SM 800A system manager.

NI Advisory - This advisory describes five vulnerabilities in the National Instruments Circuit Design Suite.

ABUB Advisory - This advisory describes an incorrect privilege assignment vulnerability in the ABUB IoT Cloud Platform.

UPDATES

Schneider Update #1 - This update provides additional information on the Schneider EcoStruxure Power Monitoring Expert advisory that was originally published on February 6^th, 2025, and most recently updated on March 27^th, 2025.

Schneider Update #2 - This update provides additional information on the Schneider EcoStruxure Power Build Rapsody advisory that was originally published on January 23, 2025.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-and-2-updates-published - subscription required.

Review – Public ICS Disclosures – Week of 5-25-24

This week we have 16 vendor disclosures from Bosch, Broadcom (3), ELECOM (4), Dassault Systèmes (2), Flexera, Hitachi, HPE, Omron (2), and SEL. There are also nine vendor updates from Hitachi Energy (2), HP (2), HPE (4), and Mitsubishi. We have 16 researcher reports for products from AutomationDirect (8), FortiGuard, libigl (6), and Nokia. Finally, we have an exploit for products from Siemens.

Advisories

Bosch Advisory - Bosch published an advisory that describes an uncontrolled resource consumption vulnerability in their CC13XX-26XX-SDK, BLE5-STACK and CC2340 SDK, BLE5-STACK products.

Broadcom Advisory #1 - Broadcom published an advisory that describes a URL parsing vulnerability in their Spring Framework product.

Broadcom Advisory #2 - Broadcom published an advisory that discusses ten vulnerabilities (three with known exploits) in their Brocade ASCG product.

Broadcom Advisory #3 - Broadcom published an advisory that describes a default community strings vulnerability in their Brocade Directors, Brocade Fabric OS, and Brocade Switches.

ELECOM Advisory #1 - JP-CERT published an advisory that describes an OS command injection vulnerability in the ELECOM WRC-X5400GS-B and WRC-X5400GSA-B wireless LAN routers.

ELECOM Advisory #2 - JP-CERT published an advisory that describes two vulnerabilities in multiple wireless LAN routers and wireless LAN repeaters from ELECOM.

ELECOM Advisory #3 - JP-CERT published an advisory that describes an OS command injection vulnerability in multiple ELECOM wireless LAN routers.

ELECOM Advisory #4 - JP-CERT published an advisory that describes three vulnerabilities in multiple ELECOM wireless LAN routers.

Dassault Advisory #1 - Dassault published an advisory that describes a deserialization of untrusted data vulnerability in their DELMIA Apriso product.

Dassault Advisory #2 - Dassault published an advisory that describes a deserialization of untrusted data vulnerability in their DELMIA Apriso product.

Flexera Advisory - Flexera published an advisory that discusses four vulnerabilities in their FlexNet Publisher.

HPE Advisory - HPE published an advisory that discusses a hardware logic contains race condition vulnerability in their ProLiant DL/ML and MicroServer products.

Omron Advisory #1 - Omron published an advisory that describes an insufficient verification of data authenticity vulnerability in their NJ/NX-series Machine Automation Controllers.

Omron Advisory #2 - Omron published an advisory that discusses three vulnerabilities in their NJ/NX-series Machine Automation Controllers.

SEL Advisory - SEL published a version update for their SEL Compass software.

Updates

Hitachi Energy Update #1 - Hitachi Energy published an update for their AFF660/665 series advisory that was originally published on January 30^th, 2024.

Hitachi Energy Update #2 - Hitachi Energy published an update for their IED ConnPacks advisory that was originally published on November 15^th, 2022. The link provided currently goes to the original version of the advisory.

HP Update #1 - HP published an update for their LaserJet Pro advisory that was originally published on February 20^th, 2024 and most recently updated on April 29^th, 2024.

HP Update #2 - HP published an update for their Laser Jet Managed Printers advisory that was originally published on February 20^th, 2024. The provided link currently goes to a blank page.

HPE Update #1 - HPE published an update for their ProLiant DL/DX/ML/SY/RL/XL/Edgeline Servers that was originally published on April 2^nd, 2024 and most recently updated on May 14^th, 2024.

HPE Update #2 - HPE published an update for their Aruba ArubaOS-CX Switches advisory that was originally published on May 8^th, 2024.

HPE Update #3 - HPE published an update for their NonStop Web ViewPoint Enterprise advisory that was originally published on April 1^st, 2024.

HPE Update #4 - HPE published an update for their Tomcat-based Servlet Engine advisory that was originally published on March 9^th, 2018.

Mitsubishi Update - Mitsubishi published an update for their MELSEC and MELIPC Series advisory that was originally published on June 14^th, 2022 and most recently updated on July 27^th, 2023.

Researcher Reports

AutomationDirect Reports - Talos Intelligence published eight reports describing 13 vulnerabilities in the AutomationDirect P3-550E PLCs.

FortiGuard Report - Horizon3 published a report that describes the identification of CVE-2024-23108 and CVE-2024-23109, command injection vulnerabilities, in the FortiGuard FortiSIEM product.

Libigl Report - Talos Intelligence published six reports describing vulnerabilities in the libigl library.

Nokia Report - IOActive published a report that describes two vulnerabilities in the Nokia FRRO501a  Industrial Fieldrouter.

Exploits

Siemens Exploit - SEC Consult published an exploit for an exposed serial shells vulnerability in the Siemens CP-XXXX Series PLCs.

For more information on these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-cd7 - subscription required.

2 Advisories and 1 Update Published – 6-15-21

Today CISA’s NCCIC-ICS published two control system security advisories for products from Automation Direct and ThroughTek. They also updated a medical device security advisory for products from OpenClinic.

Automation Direct Advisory

This advisory describes five vulnerabilities in the Automation Direct CLICK PLC CPU modules. The vulnerabilities were reported by Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans. Automation Direct has new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Authentication bypass using alternate path or channel - CVE-2021-32980, CVE-2021-32984, and CVE-2021-32986,

• Clear-text transmission of sensitive information - CVE-2021-32982, and

• Unprotected storage of credentials - CVE-2021-32978

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to log in as a currently or previously authenticated user or discover passwords for valid users.

ThroughTek Advisory

This advisory describes a clear-text transmission of sensitive information vulnerability in the ThroughTek P2P Software Development Kit (SDK). The vulnerability was reported by Nozomi Networks. ThroughTek has a new version that, along with certain setting manipulations, mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to permit unauthorized access to sensitive information, such as camera audio/video feeds.

OpenClinic Update

This update provides additional information on an advisory that was  originally published on July 2^nd, 2020 and most recently updated on August 27^th, 2020. The new information includes adding new version that mitigates the vulnerabilities.

NOTE: NCCIC-ICS forgot to refer to the previous update instead of the original version of the advisory in Section 2.