Review – Public ICS Disclosures – Week of 9-6-25 – Part 1

This week we have bulk vendor disclosures HP (6). There are also 12 vendor disclosures from Beckhoff, Bender (2), Delta Electronics, GE Vernova, Hitachi Energy, HPE (3), NI (2), and Palo Alto Networks.

Bulk Vendor Disclosures – HP

Intel UPLR2 Xeon Processor BIOS Security Updates,

Intel 2025.1 IPU – BIOS February 2025 Security Update,

AMD SMM Vulnerabilities February 2025 Security Update,

HP Hotkey Support – Escalation of Privilege,

Intel Core Ultra Processor Firmware Security Update, and

Poly Lens Desktop Application – Privilege Escalation,

Advisories

Beckhoff Advisory - Beckhoff published an advisory that describes a deserialization of untrusted data vulnerability in their TwinCAT 3 Engineering product.

Bender Advisory #1 - CERT-VDE published an advisory that describes an insufficiently protected credentials vulnerability in the Bender charge controller products.

Bender Advisory #2 - CERT-VDE published an advisory that describes a cleartext transmission of sensitive information vulnerability in the Bender charge controller products.

Delta Advisory - Delta published an advisory that describes two path traversal vulnerabilities in their DIALink product.

GE Advisory - GE published an advisory that discusses four vulnerabilities in their  Control Server, OTArmor, and Baseline Security Center (BSC) products.

Hitachi Energy Advisory - Hitachi Energy published an advisory that discusses seven vulnerabilities (one with publicly available exploit) in their RTU500 series product.

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities (one with publicly available exploit) in their Telco Unified Correlation and Automation (UCA) product.

HPE Advisory #2 - HPE published an advisory that discusses two vulnerabilities in their Intelligent Assurance Using Apache product.

HPE Advisory #3 - HPE published an advisory that discusses two vulnerabilities in their Telco Intelligent Assurance product.

NI Advisory #1 - NI published an advisory that describes a path traversal vulnerability in their USI Registration tool for DataPlugins.

NI Advisory #2 - NI published an advisory that describes a relative path traversal vulnerability in their Digilent WaveForms product.

PAN Advisory #1 - PAN published an advisory that discusses eight vulnerabilities in their Prisma Access Browser.

PAN Advisory #2 - PAN published an advisory that describes an exposure of sensitive information to an unauthorized control sphere vulnerability in their User-ID Credential Agent.

PAN Advisory #3 - PAN published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Cortex XDR Microsoft 365 Defender Pack.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-97a - subscription required.

Review – Public ICS Disclosures – Week of 4-23-22 – Part 1 -

This is another busy week necessitating two-part coverage. In part 1 this week we have nineteen vendor disclosures from ABB, Bender, Bosch, Braun (2), DrayTek, Eaton (5), HPE, Meile, PEPPERL+FUCHS, Philips (2), and Pilz (3).

ABB Advisory - ABB published an advisory discussing six vulnerabilities in their AC 500 PLCs.

Bender Advisory - CERT-VDE published an advisory describing seven vulnerabilities in the Bender/ebee Charge Controller products.

Bosch Advisory - Bosch published an advisory discussing an infinite loop vulnerability in their FL MGUARD and TC MGUARD safety devices.

Braun Advisory #1 - Braun published an advisory discussing the NAME:WRECK vulnerabilities.

Braun Advisory #2 - Braun published an advisory discussing the Amnesia:33 vulnerabilities.

DrayTek Advisory - DrayTek published an advisory discussing an infinite loop vulnerability in their Vigor routers.

Eaton Advisory #1 - Eaton published an advisory discussing TLStorm vulnerabilities and the Havex trojan as being used by the Berserk Bear APT group against UPS systems.

Eaton Advisory #2 - Eaton published an advisory discussing the SpringShell vulnerabilities.

Eaton Advisory #3 - Eaton published an advisory discussing sixteen vulnerabilities (six with known exploits) in their Form 7 recloser control. These are third-party (CODESYS) vulnerabilities.

Eaton Advisory #4 – Eaton published an advisory discussing the INCONTROLLER ICS attack tools.

Eaton Advisory #5 - Eaton published an advisory discussing the TLStorm vulnerabilities.

HPE Advisory - HPE published an advisory discussing three vulnerabilities (one with known exploits) in their SimpliVity Omnistack for Hyper-V.

Meile Advisory - CERT-VDE published an advisory describing an improper privilege management vulnerability (with publicly available exploit) in their Benchmark Programming Tool.

PEPPERL+FUCHS Advisory - CERT-VDE published an advisory discussing a remote code execution vulnerability in VisuNet devices from PEPPERL+FUCHS.

Philips Advisory #1 - Philips published an advisory discussing a remote code execution vulnerability.

Philips Advisory #2 - Philips published an advisory discussing a denial of service vulnerability.

Pilz Advisory #1 - CERT-VDE published an advisory discussing ten vulnerabilities (one with publicly available exploit) in the Pilz PMC programming tool.

Pilz Advisory #2 - CERT-VDE published an advisory discussing 27 vulnerabilities (nine with publicly available exploits) in the Pilz PMC programming tool.

Pilz Advisory #3 - CERT-VDE published an advisory discussing 18 vulnerabilities (four with publicly available exploits) in motion controller products from Pilz.

 

For more details on these advisories, including links to 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-bda - subscription required.

Public ICS Disclosures – Week of 10-10-20 – Part 1

This week we have seven vendor disclosures from Eaton, HMS, Bender, Sprecher, Bosch, Rockwell, and Carestream. There are also three vendor updates from ABB and Eaton (2). We also have an exploit that was published for products from BACnet Interoperability Test Services, Inc.

Eaton Advisory

Eaton published an advisory for the CodeMeter vulnerabilities in their Xsoft-CODESYS programming software.

NOTE: This is the first CodeMeter advisory that is specifically tied to the 4th party CODESYS implmenetation of the Wibu-Systems code that I have seen.

HMS Advisory

HMS published an advisory for the Ripple20 [corrected link, 10-18-20 0846 EDT] vulnerabilities, reporting that none of their products are affected.

NOTE: The advisory indicates that HMS employed a third-party research firm to help them assess the potential exposure to these vulnerabilities.

Bender Advisory

Bender published an advisory describing an improper authentication vulnerability in their COMTRAXX products. The vulnerability was reported by Maxim Rupp. Bender has a new software version that mitigates the vulnerability. There is no indication that Maxim has been provided an opportunity to verify the efficacy of the fix.

Sprecher Advisory

Sprecher published an advisory describing an input validation vulnerability in their SPRECON-E engineering tools. The vulnerability was reported by Gregor Bonney of CyberRange-e at Innogy. Sprecher has a firmware update that mitigates the vulnerability. There is no indication that Bonney has been provided an opportunity to verify the efficacy of the fix.

Bosch Advisory

Bosch published an advisory describing the Microsoft® remote desktop services vulnerability in their Rexroth industrial PCs.

Rockwell Advisory

Rockwell published an advisory describing five buffer overflow vulnerabilities in their 1794-AENT Flex I/O products. The vulnerabilities were reported (here, here and here) by Jared Rittle of Cisco Talos. Rockwell provides generic workarounds to mitigate these vulnerabilities.

NOTE: The Cisco Talos reports provide proof-of-concept code for the vulnerabilities.

Carestream Advisory

Carestream published an advisory [.PDF download link] describing the Microsoft Bad Neighbor vulnerability. Carestream is looking into the potential effects of this vulnerability on their products.

ABB Update

ABB published an update of their CodeMeter advisory for their Automation Builder products that was originally published on September 17^th, 2020. ABB reports that CVE-2020-14517 has not been closed in the latest version of the Wibu-Systems CodeMeter (v.7.10a). That version has been integrated into the latest version of Automation Builder.

Eaton Updates

Eaton published an update for their Ripple20 [Corrected link, 10-18-20, 0851 EDT] advisory that was originally published on June 23^rd, 2020 and most recently updated on July 24^th, 2020. The new information includes updated mitigation information for Form 4D.

Eaton published an update for their Triangle MicroWorks DNP3 Outstation Libraries vulnerability advisory that was originally published on April 22^nd, 2020 and most recently updated on August 6^th, 2020. Eaton has updated their affected product list and mitigation measures.

NOTE: The NCCIC-ICS advisory was never updated to provide links to vendors reporting these library vulnerabilities in their products.

BACnet Exploit

Zero Science Lab published an exploit for a remote denial of service vulnerability in the BACnet Test Server from BACnet Interoperability Test Services, Inc. There is no report of a coordinated disclosure or CVE # for this vulnerability so it looks like it may be a 0-day exploit.

More to Come

Part II of this post will include Schneider and Siemens advisories and updates.