Review – Public ICS Disclosures – 6-13-26 – Part 1

This is a moderately busy disclosure week.  For Part 1 we have 11 vendor disclosures from Arista, Belden, Dell (2), Dassault, Genetec, HP (2), HPE (2), and iba. 

Advisories  

Arista Advisory - Arista published an advisory that discusses the AirSnitch attacks. 

Belden Advisory - Belden published an advisory that describes a download of code without integrity check vulnerability in their Hirschmann Rail Data Diode. 

Dell Advisory #1 - Dell published an advisory that discusses three vulnerabilities in their Wyse Management Suite. 

Dell Advisory #2 - Dell published an advisory that describes two vulnerabilities in their Wyse Management Suite. 

Dassault Advisory - Dassault published an advisory that describes a path traversal vulnerability in their SOLIDWORKS Visualize product. 

NOTE: Dassault only provides access to advisories to registered owners. 

Genetec Advisory - Genetec published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Security Center systems main server installations. 

HP Advisory #1 - HP published an advisory that discusses an insufficient granularity of access control vulnerability in their business notebook and desktop PCs. 

HP Advisory #2 - HP published an advisory that discusses three vulnerabilities in their One Agent Software Bundled with HP Privacy Settings. 

HPE Advisory #1 - HPE published an advisory that discusses an improper initialization vulnerability in their SimpliVity Servers. 

HPE Advisory #2 - HPE published an advisory that discusses an improper access control for register interface vulnerability in their SimpliVity AMD Servers. 

Iba Advisory - CERT-VDE published an advisory that describes a deserialization of untrusted data vulnerabilities in the iba ibaDatCoordinator and ibaPDA products. 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-6-13-26-part - subscription required. 

Review – Public ICS Disclosures – Week of 3-28-26 – Part 1

This week is a relatively busy disclosure week. We have 15 vendor disclosures from ABB, Baade, Belden, Fuji Electric, Endress+Hauser, Dassault (3), HP (2), HPE, MB Connect (2), Philips, and TP-Link. 

 

Advisories  

 

ABB Advisory - ABB published an advisory that discusses 16 vulnerabilities (seven with publicly available exploits) in their System 800xA. 

Baade Advisory - CERT-VDE published an advisory that discusses a heap-based buffer overflow vulnerability in the Baade 1xCOM and 4xCOM products. 

Belden Advisory - Belden published an advisory that discusses two out-of-bounds write vulnerabilities in their NetModule Router Software. 

Fuji Advisory - JP-CERT published an advisory that describes five vulnerabilities in the Fuji V-SFT product. 

Endress+Hauser Advisory - CERT-VDE published an advisory that discusses 16 vulnerabilities in multiple Endress+Hauser products. 

Dassault Advisory #1 - Dassault published an advisory that describes a path traversal vulnerability in their DELMIA Factory Resource Manager. 

Dassault Advisory #2 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ELMIA Factory Resource Manager. 

Dassault Advisory #3 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Collaborative Industry Innovator. 

HP Advisory #1 - HP published an advisory that discusses three vulnerabilities in multiple HP workstations. 

HP Advisory #2 - HP published an advisory that discusses the use of an outdated 4th party (Chromium) software package in multiple HP workstations. 

HPE Advisory - HPE published an advisory that discusses an improper input validation vulnerability in their Telco Network Function Virtual Orchestrator. 

MB Connect Advisory #1 - MB Connect published an advisory that describes five vulnerabilities in their mbCONNECT24 and mymbCONNECT24 products. 

MB Connect Advisory #2 - MB Connect published an advisory that describes two vulnerabilities in their mbCONNECT24 and mymbCONNECT24 products. 

Philips Advisory - Philips published an advisory that discusses the Microsoft Secure Boot certificates issue. 

TP-Link Advisory - TP-Link published an advisory that describes three vulnerabilities in their Tapo C520WS Wi-Fi cameras. 

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-3-964 - subscription required.