Review – Public ICS Disclosures – Week of 2-7-26 – Part 1

This is a relatively busy disclosure week for the week of Cyber Tuesday. We have 43 bulk vendor disclosures from FortiGuard (6), Hitachi (8), HP (8), HPE (14), QNAP (7). We also have 10 bulk updates from Siemens (10). There are also seven other vendor disclosures from Bosch, Meinberg, Pheonix Contact, Schneider (2), and Siemens (2).

Bulk Disclosures – FortiGuard

• Firewall policy bypass in FSSO Terminal Services Agent,

• Format String Vulnerability in CAPWAP fast-failover mode,

• LDAP authentication bypass in Agentless VPN and FSSO,

• Request smuggling attack in FortiOS GUI,

• SSL-VPN Symlink Persistence Patch Bypass, and

• XSS via back button.

Bulk Disclosures – Hitachi

• Multiple Vulnerabilities in Cosminexus HTTP Server,

• Vulnerability in Cosminexus HTTP Server,

• Vulnerability in Cosminexus HTTP Server and Hitachi Web Server,

• Multiple Vulnerabilities in Cosminexus HTTP Server and Hitachi Web Server,

• Multiple Vulnerabilities in Cosminexus,

• Multiple Vulnerabilities in JP1,

• Multiple Vulnerabilities in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center, and

• Multiple Vulnerabilities in Hitachi Command Suite products

Bulk Disclosures – HP

• HP App – Potential Cross-Site Scripting,

• AMD Graphics Driver February 2026 Security Update,

• AMD Processors February 2026 Security Update,

• Certain HP OfficeJet Pro Printers – Denial of Service,

• Intel Chipset Firmware February 2026 Security Update,

• Intel Processor Firmware February 2026 Security Update,

• Certain HP OfficeJet Pro Printers - Information Disclosure, and

• Intel Graphics Software February 2026 Security Update.

Bulk Disclosures – HPE

• Certain HPE ProLiant Servers Using Certain Intel Processor BIOS, INTEL-SA-01406, Intel Quick Assist Technology (Intel QAT) Advisory, Multiple vulnerabilities,

• Certain HPE SimpliVity Servers Using Certain Intel Processors, INTEL-SA-01313, 2025.3 IPU, Intel Xeon Processor Firmware Advisory, Multiple Vulnerabilities,

• Certain HPE SimpliVity Servers Using Certain Intel Processors, INTEL-SA-01280, 2025.3 IPU, Intel Chipset Firmware Advisory, Multiple Vulnerabilities,

• Certain HPE SimpliVity Servers Using Certain Intel Processors, INTEL-SA-01312, Intel TDX Module Advisory, Multiple Vulnerabilities,

• Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01396, 2026.1 IPU, Intel Processor Firmware Advisory, Local Escalation of Privilege Vulnerability,

• Certain HPE ProLiant DL/ML/XD, Synergy, Edgeline and Alletra Servers Using Certain Intel Processors, INTEL-SA-01314, 2025.4 IPU, Intel TDX Module Advisory, Local Escalation of Privilege Vulnerability,

• Certain HPE ProLiant DL/ML/XD, Synergy, Edgeline, and Alletra Servers Using Certain Intel • Processors, INTEL-SA-01397, 2026.1 IPU, Intel Trust Domain Extensions (Intel TDX) module Advisory, Multiple Vulnerabilities,

• Certain HPE ProLiant DL/ML/XD, Synergy, and Alletra Servers Using Certain Intel Processors, INTEL-SA-01401, UPLR1 - Intel Server Firmware Advisory, Local Denial of Service Vulnerability,

• HPE Aruba Networking EdgeConnect SD-WAN Orchestrator, Multiple Vulnerabilities,

• Certain HPE ProLiant AMD DL/XL Servers Using Certain AMD EPYC Processors, AMD-SB-3023:AMD Server Vulnerabilities, Multiple Vulnerabilities,

• HPE Intel E810 Series Ethernet Controllers, INTEL-SA-01171, Intel Ethernet Adapters 800 Series Advisory, Denial of Service Vulnerability,

• Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01314, 2025.4 IPU, Intel TDX Module Advisory, Local Escalation of Privilege Vulnerability,

• Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01397, 2026.1 IPU, Intel Trust Domain Extensions (Intel TDX) module Advisory, Multiple Vulnerabilities, and

• Multiple Vulnerabilities in HPE Aruba Networking Private 5G Core.

Bulk Disclosures – QNAP

• Multiple Vulnerabilities in Media Streaming add-on,

• Multiple Vulnerabilities in Qsync Central,

• Multiple Vulnerabilities in File Station 5,

• Vulnerabilities in Apache,

• Multiple Vulnerabilities in QTS and QuTS hero, 

• Multiple Vulnerabilities in QuTS hero, and

• Vulnerabilities in Samba.

Bulk Updates – Siemens

• Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1,

• Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2,

• Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices,

• Denial-of-Service Vulnerability in ET 200 Devices,

• Multiple Vulnerabilities in SiPass integrated,

• Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices,

• DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery,

• Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1,

• Vulnerabilities in EFI variable of SIMATIC IPCs, SIMATIC Tablet PCs, and SIMATIC Field PGs, and

• Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5.

Advisories

Bosch Advisory - Bosch published an advisory that describes four deserialization of untrusted data vulnerabilities in their Rexroth IndraWorks product.

Meinberg Advisory - Meinberg published an advisory that discusses 21 vulnerabilities in their LANTIME product.

Pheonix Contact Advisory - Pheonix Contact published an advisory that discusses an improperly controlled sequential memory allocation vulnerability in their mGuard products.

Schneider Advisory #1 - Schneider published an advisory that describes an improper check for unusual or exceptional conditions vulnerability in their SCADAPack and Remote Connect products.

Schneider Advisory #2 - Schneider published an advisory that describes two vulnerabilities in their EcoStruxureTM Building Operation Workstation and EcoStruxureTM Building Operation Webstation products.

Siemens Advisory #1 - Siemens published an advisory that describes six vulnerabilities in their Simcenter Femap and Nastran products.

Siemens Advisory #2 - Siemens published a bulletin that describes an absence of anti-tamper protections and modern exploit mitigation controls in the SIPORT Desktop Client Application.

 

For more information on these disclosures, including links to 3^rd party advisories, and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-fdd - subscription required.

Review – Public ICS Disclosures – Week of 11-15-25 – Part 1

This week we have bulk disclosures from FortiGuard (6). We have 11 additional vendor disclosures from ABB, Bosch (4), HPE (4), Mitsubishi, and Philips.

Bulk Disclosures - FortiGuard

• Stack buffer overflow in CAPWAP daemon,

• Stack buffer overflow in CAPWAP daemon,

• Authenticated CLI Commands Buffer Overflow,

• Credential leakage through debug commands,

• File scan result bypass, and

• Trusted hosts bypass via SSH.

Advisories

ABB Advisory - ABB published an advisory that describes an authentication bypass using alternate path or channel vulnerability in their Edgenius Management Portal.

Bosch Advisory #1 - Bosch published an advisory that discusses two vulnerabilities (one with a publicly available exploit) in their MAP 5000 family.

Bosch Advisory #2 - Bosch published an advisory that describes an inadequate encryption strength vulnerability in their MAP 5000 panel.

Bosch Advisory #3 - Bosch published an advisory that discusses a double free vulnerability in their MAP 5000 family.

Bosch Advisory #4 - Bosch published an advisory that describes a use of a broken or risky cryptographic algorithm vulnerability in their MAP 5000 family.

HPE Advisory #1 - HPE published an advisory that discusses three vulnerabilities in their Telco Service Activator.

HPE Advisory #2 - HPE published an advisory that discusses an improper isolation or compartmentalization vulnerability in their Compute Scale-up Server 3200 Platform Servers.

HPE Advisory #3 - HPE published an advisory that describes seven vulnerabilities (five with publicly available exploits) in their Aruba Networking Management Software (AirWave).

HPE Advisory #4 - HPE published an advisory that discusses 13 vulnerabilities (six with publicly available exploits) in their Aruba Networking AOS-CX.

Mitsubishi Advisory - Mitsubishi published an advisory that describes an uncontrolled search path element vulnerability in their MILCO.S lighting control system.

Philips Advisory - Philips published an advisory that discusses a Microsoft double free vulnerability that is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

 

For more information on these disclosures, including links to 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-6f4 - subscription required.

Review – Public ICS Disclosures – Week of 10-11-25 – Part 1

This week is a relatively light disclosure week for cyber week. For Part 1 we have 35 bulk disclosures from Broadcom (8), Dassault Systems (5), FortiGuard (17), and HPE (5).  We have additional 10 vendor disclosures from Bosch (2), Delta Electronics, Eaton, HP (3), Moxa, Murrelektronik, and Philips.

Bulk Disclosures

Broadcom Advisories

• Brocade ASCG Vulnerability Disclosures,

• jwt-go allows excessive memory allocation during header parsing,

• Rocky Linux Updates in ASCG 3.3.0a (OVA),

• eventlet before 0.35.2 as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution,

• Libexpat: expat: improper restriction of xml entity expansion depth in libexpat,

• A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing,

• Certifi Vulnerable to Insufficient Verification of Data Authenticity via GlobalTrust Root Certificate, and

• Kernel OVA security updates in ASCG 3.3.0a

Dassault Advisories

• Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer,

• OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform,

• Stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer,

• Stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator, and

• Stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager

FortiGuard Advisories

• Authenticated Heap Overflow in SSL-VPN bookmarks,

• Domain fronting protection bypass in explicit web proxy,

• FGFM protocol allows unauthenticated reset of the connection,

• Heap Overflow in fgfmsd,  

• Heap buffer overflow in websocket,  

• Improper autorization over static files,  

• Insertion of Sensitive 2FA Information in logs and debug command,

• Insertion of Sensitive Information Into Sent Data Vulnerability in csfd daemon,  

• Insufficient Session Expiration in SSLVPN using SAML authentication,  

• Missing authentication check in OFTP service,  

• Multiple Unchecked Return Value leading to Null Pointer Dereference,  

• Open Redirect and XSS in Web Filter warning page,  

• Race condion in FortiCloud SSO SAML authentication,

• Restricted CLI command bypass,

• Stack-based buffer overflow on fortitoken import feature,

• Weak authentication in WAD/GUI, and

• ZTNA Server Improper Certificate Validation  

HPE Advisories

• HPESBNW04958 rev.1 - HPE Aruba Networking AOS-8 Instant AP and AOS-10 AP, Multiple Vulnerabilities,

• HPESBNW04957 rev.1 - HPE Aruba Networking AOS-10 and AOS-8 Mobility Conductor, Controllers, and Gateways, Multiple Vulnerabilities,

• HPESBHF04956 rev.1 - Certain HPE ProLiant AMD Servers Using Certain AMD EPYC Processors, AMD-SB-3020: SEV-SNP RMP Initialization Vulnerability, Local Unauthorized Access Vulnerability,

• HPESBHF04952 rev.1 - HPE ProLiant RL300 Gen11 Server, Out-of-Bound Reads Vulnerability, and

• HPESBHF04954 rev.1 - HPE Compute Scale-up Server 3200 Platform and Superdome Flex 280 servers, Security Bypass Vulnerability 

Advisories

Bosch Advisory #1 - Bosch published an advisory that describes three vulnerabilities in their ctrlX OS Setup application.

Bosch Advisory #2 - Bosch published an advisory that discusses an allocation of resources without limits or throttling vulnerability in their Rexroth Fieldbus Couplers.

Delta Advisory - Delta published an advisory that describes two stack-based buffer overflow vulnerabilities in their ASDA-Soft product.

Eaton Advisory - Eaton published an advisory that describes an uncontrolled search path vulnerability in their Intelligent Power Protector (IPP) software.

HP Advisory #1 - HP published an advisory that discusses three vulnerabilities in multiple HP product lines.

HP Advisory #2 - HP published an advisory that discusses two incorrect privilege assignment vulnerabilities in multiple product lines using Sound Research SECOMN64 driver.

HP Advisory #3 - HP published an advisory that discusses an improper access control for register interface vulnerability in multiple HP product lines.

Moxa Advisory - Moxa published an advisory that describes five vulnerabilities in their Network Security Appliances and Routers.

Murrelektronik Advisory - CERT-VDE published an advisory that describes a clear-text transmission of sensitive information vulnerability in the Murrelektronik IMPACT67 Pro products.

Philips Advisory - Philips published an advisory that discusses CISA Emergency Directive 26-01.

 

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-74f - subscription required.

Review – Public ICS Disclosures – Week of 8-9-25 – Part 1

This is a relatively busy cyber week. For Part 1 we have a bulk vendor disclosure from HPE (22). There are 15 additional vendor disclosures from ABB (2), Bosch (2), FortiGuard (6), and HP (5).

Bulk Disclosures

HPE – 22 advisories

Advisories

ABB Advisory #1 - ABB published an advisory that describes a missing authentication for critical function vulnerability in their Ability zenon Runtime product.

ABB Advisory #2 - ABB published an advisory that describes seven vulnerabilities in their Aspect products.

Bosch Advisory #1 - Bosch published an advisory that describes three vulnerabilities in their ctrlX OS Setup app.

Bosch Advisory #2 - Bosch published an advisory that discusses an allocation of resources without limit or throttling vulnerability in their Rexroth Fieldbus Couplers.

FortiGuard Advisory #1 - FortiGuard published an advisory that describes a path traversal vulnerability in their FortiManager products.

FortiGuard Advisory #2 - FortiGuard published an advisory that describes a double free vulnerability in multiple FortiGuard products.

FortiGuard Advisory #3 - FortiGuard published an advisory that describes an incorrect privilege assignment vulnerability in their FortiOS products.

FortiGuard Advisory #4 - FortiGuard published an advisory that describes an integer overflow or wraparound vulnerability in multiple FortiGuard products.

FortiGuard Advisory #5 - FortiGuard published an advisory that describes an authentication bypass using an alternate path or traverse vulnerability in multiple FortiGuard products.

FortiGuard Advisory #6 - FortiGuard published an advisory that discusses an allocation of resources without limit or throttling vulnerability (with publicly available exploit) in multiple FortiGuard products.

HP Advisory #1 - HP published an advisory discusses 15 vulnerabilities in their AMD Client UEFI Firmware.

HP Advisory #2 - HP published an advisory that discusses an improper isolation or compartmentalization vulnerability in multiple HP products.

HP Advisory #3 - HP published an advisory that describes an improper restriction of software interfaces to hardware features vulnerability in the BIOS for multiple HP products.

HP Advisory #4 - HP published an advisory that discusses a TOCTOU race condition vulnerability in multiple HP products.

HP Advisory #5 - HP published an advisory that discusses an improper check for unusual or exceptional conditions vulnerability in multiple HP products.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-fcc - subscription required.

Review – Public ICS Disclosures – Week of 4-26-25 – Part 1

For Part 1 this week we have 11 vendor disclosures from ABB (3), Bosch, Broadcom, Dassault Systems (2), HPE, Philips, and Sick (2).

Advisories

ABB Advisory #1 - ABB published an advisory that describes three vulnerabilities in their ABB Network Card.

ABB Advisory #2 - ABB published an advisory that describes two vulnerabilities in their Automation Builder product.

ABB Advisory #3 - ABB published an advisory that discusses an access of uninitialized pointer vulnerability in their Ekip Com IEC61850 product.

Bosch Advisory - Bosch published an advisory that describes 15 vulnerabilities (with publicly available exploits) in their Rexroth AG ctrlX OS products.

Broadcom Advisory - Broadcom published an advisory that discusses two vulnerabilities in multiple Brocade products.

Dassault Systems Advisory #1 - Dassault Systems published an advisory that describes a use-after-free vulnerability in their SOLIDWORKS eDrawings.

Dassault Systems Advisory #2 - Dassault Systems published an advisory that describes an out-of-bounds write vulnerability in their SOLIDWORKS eDrawings application.

HPE Advisory - HPE published an advisory that discusses a heap-based buffer overflow vulnerability in their Superdome Flex, Superdome Flex 280, and Compute Scale-up Server 3200 products.

Philips Advisory - Philips published an advisory that discusses the SAP NetWeaver vulnerability.

Sick Advisory #1 - Sick published an advisory that describes two vulnerabilities in their Flexi Compact products.

Sick Advisory #2 - Sick published an advisory that describes 23 vulnerabilities in their picoScan and multiScan products.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-a52 - subscription required.

Review – Public ICS Disclosures – Week of 4-19-25 – Part 1

This week we have 18 vendor disclosures from Bosch, Broadcom, CODESYS, Hitachi (3), HPE (6), Milestone, Mitsubishi, Philips (2), and SEL (2).

Advisories

Bosch Advisory - Bosch published an advisory that describes 15 vulnerabilities in their ctrlX OS product.

Broadcom Advisory - Broadcom published an advisory that discusses an improper isolation or compartmentalization vulnerability in multiple Broadcom products.

CODESYS Advisory - CODESYS published an advisory that describes a forced browsing vulnerability in multiple CODESYS products.

Hitachi Advisory #1 - Hitachi published an advisory that discusses three vulnerabilities (one with publicly available exploit) in their JP1/Automatic Operation products.

Hitachi Advisory #2 - Hitachi published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Ops Center Common Services within Hitachi Ops Center OVA.

Hitachi Advisory #3 - Hitachi published an advisory that describes a use of default credentials vulnerability in Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF.

HP Advisory - HP published an advisory that discusses two vulnerabilities in multiple HP products.

HPE Advisory #1 - HPE published an advisory that discusses five vulnerabilities (3 with publicly available exploits, one listed in CISA’s KEV catalog) in their Telco Unified OSS Console.

HPE Advisory #2 - HPE published an advisory that discusses four vulnerabilities (one with publicly available exploit) in their Superdome Flex 280 and Compute Scale-up Server 3200 platforms.

HPE Advisory #3 - HPE published an advisory that discusses an OS command injection vulnerability in their SAN Switches with Brocade Fabric OS.

HPE Advisory #4 - HPE published an advisory that discusses 13 vulnerabilities in their Telco Network Function Virtualization Orchestrator Software.

HPE Advisory #5 - HPE published an advisory that discusses a deserialization of untrusted data vulnerabilities (listed in CISA’s KEV catalog) vulnerability in their Telco Service Orchestrator.

HPE Advisory #6 - HPE published an advisory that discusses three vulnerabilities in their Telco Service Activator.

Milestone Advisory - Milestone published an advisory that describes a missing encryption of sensitive data vulnerability in their XProtect installer.

Mitsubishi Advisory - Mitsubishi published an advisory that describes an improper validation of specified quantity in input vulnerability in multiple FA products.

Philips Advisory #1 - Philips published an advisory that discusses five Apple vulnerabilities.

Philips Advisory #2 - Philips published an advisory that discusses two Google Chrome vulnerabilities.

SEL Advisory #1 - SEL published a software update notice that includes cybersecurity enhancements for their SEL-5702 Synchrowave Operations product.

SEL Advisory #2 - SEL published a software update notice that includes cybersecurity enhancements for their Blueframe OS.

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-83e - subscription required.

Review – Public ICS Disclosures – Week of 1-18-25

This week we have seven vendor disclosures from Bosch, CODESYS, Delta Electronics, HPE, Palo Alto Networks, QNAP, and SonicWall. We also have five updates from ABB, FortiGuard (3) and HPE. Finally, we have an exploit for a vulnerability in a product from Forescout.

Advisories

Bosch Advisory - Bosch published an advisory that describes an unquoted service path enumeration vulnerability in their DIVAR IP all-in-one 7000 product.

CODESYS Advisory - CODESYS published an advisory that discusses an observable discrepancy vulnerability with publicly available exploit in the CODESYS Key USB dongle.

Delta Advisory - Delta published an advisory that describes a heap-based buffer overflow vulnerability in their CNCSoft-G2.

HPE Advisory - HPE published an advisory that discusses an inefficient regular expression complexity vulnerability in their Telco Service Orchestrator.

Palo Alto Networks Advisory - Palo Alto Networks published an advisory that discusses 20 vulnerabilities (11 with publicly available exploits) in their PAN-OS product.

QNAP Advisory - QNAP published an advisory that discusses six vulnerabilities in their HBS 3 Hybrid Backup Sync product.

SonicWall Advisory - SonicWall published an advisory that describes a deserialization of untrusted data vulnerability that is listed in the CISA Known Exploited Vulnerabilities catalog.

Updates

FortiGuard Advisory #1 - FortiGuard published an update for their Node.js websocket module advisory that was originally published on January 14^th, 2025.

FortiGuard Advisory #2 - FortiGuard published an update for their captive portal advisory that was originally published on February 27^th, 2024.

FortiGuard Advisory #3 - FortiGuard published an update for their multiple logic flaws advisor that was originally published on January 14^th, 2025.

HPE Update - HPE published an update for their RADIUS protocol advisory that was originally published on July 9^th, 2024, and most recently updated on October 9^th, 2024.

Exploits

Forescout Exploit - Nightsedge published an exploit for a creation of a temporary in directory with insecure permissions vulnerability in the Forescout SecureConnector.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-423 - subscription required.

Review – 3 Advisories Published – 11-7-24

Today, CISA’s NCCIC-ICS published three control system security advisories for products from Bosch, Delta Electronics, and Beckhoff Automation.

Advisories

Bosch Advisory - This advisory describes an uncontrolled resource consumption vulnerability in the Bosch Rexroth AG IndraDrive.

Delta Advisory - This advisory describes three stack-based buffer overflow vulnerabilities in the Delta DIAScreen.

Beckhoff Advisory - This advisory describes an OS command injection vulnerability in the Beckhoff TwinCAT Package Manager.

 

For more information on these advisories, including a look at additional Delta vulnerabilities – see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-published-11-7-24 - subscription required.

Review – Public ICS Disclosures – Week of 10-25-24 – Part 1

This week, for Part 1, we have 20 vendor disclosures from Broadcom (8), Beckhoff, Bosch, GE Vernova (2), Hikvision, Hitachi Energy (2), HP (3), HPE, and Omron.

Advisories

Broadcom Advisory #1 - Broadcom published an advisory that discusses a function call with incorrect argument type vulnerability in their SANnav product.

Broadcom Advisory #2 - Broadcom published an advisory that discusses an integer overflow or wrap around vulnerability in their SANnav product.

Broadcom Advisory #3 - Broadcom published an advisory that discusses nine vulnerabilities (three with publicly available exploits) in their Fabric OS, SANnav, and ASCG products.

Broadcom Advisory #4 - Broadcom published an advisory that discusses an incorrect resource transfer between spheres vulnerability in their SANnav product.

Broadcom Advisory #5 - Broadcom published an advisory that discusses two vulnerabilities (one with publicly available exploit) in their SANnav product.

Broadcom Advisory #6 - Broadcom published an advisory that discusses an incomplete cleanup vulnerability in their SANnav product.

Broadcom Advisory #7 - Broadcom published an advisory that discusses three inadequately described vulnerabilities in their SANnav product.

Broadcom Advisory #8 - Broadcom published an advisory that discusses six vulnerabilities in their SANnav products.

Beckhoff Advisory - CERT-VDE published an advisory that describes an OS command injection vulnerability in the Beckhoff TwinCAT Package Manager.

Bosch Advisory - Bosch published an advisory that describes an uncontrolled resource consumption vulnerability in the PROFINET stack implementation of the IndraDrive.

GE Vernova Advisory #1 - GE published an advisory that discusses two vulnerabilities in Control Server installations that use VMware vCenter Server.

GE Vernova Advisory #2 - GE published an advisory that describes a side-channel key recovery vulnerability in YubiKey’s in customers using Xona devices and those using YubiKey authentication for certain HMI deployments.

Hikvision Advisory - JP- CERT published an advisory that announces firmware updates for multiple network cameras as a security enhancement, changing the behavior to communicate with Dynamic DNS services, to prevent cleartext transmission.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that describes two vulnerabilities in their TRO600 series products.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that discusses two vulnerabilities (both with publicly available exploits) in their MSM product web services.

HP Advisory #1 - HP published an advisory that discusses the PixieFail vulnerabilities.

HP Advisory #2 - HP published an advisory that discusses 353 vulnerabilities in their ThinPro product.

HP Advisory #3 - HP published an advisory that describes an out-of-bounds write vulnerability in their Smart Universal Printing Driver.

HPE Advisory - HPE published an advisory that discusses the regreSSHion vulnerability.

Omron Advisory - Omron published an advisory that describes an improper authorization vulnerability in their Sysmac Studio product.

 

For more information about these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-25a - subscription required.

Review – Public ICS Disclosures – Week of 10-12-24 – Part 1

This week we have vendor disclosures from Belden, Bosch, Dassault Systèmes (2), Helmholtz (2), Hikvision, HP (3), HPE (3), MB Connect (2), Meinberg, Moxa, Philips (2), and Sick.

Advisories

Belden Advisory - Belden published an advisory that describes a heap overflow vulnerability (with publicly available exploit) in their Hirschman HilCOS product line.

Bosch Advisory - Bosch published an advisory that describes an unrestricted resource consumption vulnerability in their VMS Central Server.

Dassault Systèmes Advisory #1 – Dassault Systèmes published an advisory that describes an authorization bypass through user-controlled keys vulnerability in their 3DSwymer.

Dassault Systèmes Advisory #2 – Dassault Systèmes published an advisory that describes a cross-site scripting vulnerability in their ENOVIA product.

Helmholtz Advisory #1 - CERT-VDE published an advisory that describes two vulnerabilities in multiple Helmholtz products.

Helmholtz Advisory #2 - CERT-VDE published an advisory that describes five vulnerabilities in the Helmholtz REX100 industrial router.

Hikvision Advisory - Hikvision published an advisory that describes three vulnerabilities in their HikCentral product series.

HP Advisory #1 - HP published an advisory that describes a missing authentication for critical function vulnerability in their DesignJet products.

HP Advisory #2 - HP published an advisory that discusses an incorrect behavior order vulnerability in their SMI Transfer Monitor.

HP Advisory #3 - HP published an advisory that discusses 12 vulnerabilities in multiple HP products.

HPE Advisory #1 - HPE published an advisory that discusses a code injection vulnerability in their Cray and ProLiant XL Servers.

HPE Advisory #2 - HPE published an advisory that discusses an incomplete filtering of special elements vulnerability in their ProLiant DX Servers.

HPE Advisory #3 - HPE published an advisory that discusses an insufficient control flow management vulnerability in their ProLiant DX Servers.

MB Connect Advisory #1 - CERT-VDE published an advisory that describes two vulnerabilities in multiple MB Connect products.

MB Connect Advisory #2 - CERT-VDE published an advisory that describes five vulnerabilities in the mbNET.mini product.

Meinberg Advisory - Meinberg published an advisory that discusses five vulnerabilities in their LANTIME product.

Moxa Advisory - Moxa published an advisory that describes two vulnerabilities in their MXsecurity Series products.

Philips Advisory #1 - Philips published an advisory that discusses two recent MS Windows vulnerabilities (CVE-2024-43572 and CVE-2024-43573) listed on CISA’s Known Exploited Vulnerabilities catalog.

Philips Advisory #2 - Philips published an advisory that discusses two recent Cisco vulnerabilities (CVE-2024-20393 and CVE-2024-20470).

Sick Advisory - Sick published an advisory that describes a use of hard-coded credentials vulnerability in multiple Sick products.

 

For more information about these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-4a8 - subscription required.

Review – Public ICS Disclosures – Week of 9-28-24

This week we have 13 vendor disclosures from Bosch (2), Cisco, DrayTek (2), Hitachi, HP, JTEKT, QNAP, SEL (2), Splunk, Westermo, and WithSecure. We have two vendor updates from Dell. Finally, we have two exploits for products from ABB and Blackberry.

Advisories

Bosch Advisory #1 - Bosch published an advisory that describes a sensitive information disclosure vulnerability in their Configuration Manager.

Bosch Advisory #2 - Bosch published an advisory that discusses three vulnerabilities in their PRC7000 product.

Cisco Advisory - Cisco published an advisory that describes two vulnerabilities in their Small Business Dual WAN Gigabit VPN Routers.

DrayTek Advisory #1 - DrayTek published an advisory that describes 14 vulnerabilities (with exploits available) in multiple Vigor routers.

DrayTek Advisory #2 - DrayTek published an advisory that describes seven classic buffer overflow vulnerabilities in multiple Vigor routers.

Hitachi Advisory - Hitachi published an advisory that discusses an improper input validation vulnerability in their Cosminexus Component Container.

HP Advisory - HP published an advisory that describes an escalation of privilege vulnerability in their business notebook PCs.

QNAP Advisory - QNAP published an advisory that discusses the CUPS vulnerabilities.

SEL Advisory #1 - SEL published a new version notice for their SEL-5030 acSELerator QuickSet Software that includes a description of a cybersecurity enhancement.

SEL Advisory #2 - SEL published a new version notice for their SEL-5813 Backup and Recovery Tool (BaRT) that includes a description of a cybersecurity enhancement.

Splunk Advisory - Splunk published an advisory that discusses four vulnerabilities in their Add-on for Amazon Web Services.

Westermo Advisory - Westermo published an advisory that describes a session hijacking vulnerability in their IbexOS Web Interface.

WithSecure Advisory - WithSecure published an advisory that describes a denial-of-service vulnerability in their Atlant Product.

Updates

Dell Update #1 - Dell published an update for their ThinOS advisory that was originally published on September 9^th, 2024, and most recently updated on September 18^th, 2024. The

Dell Update #2 - Dell published an update for their ThinOS advisory that was originally published on June 12^th, 2024, and most recently updated on September 9^th, 2024.

Exploits

ABB Exploit - LiquidWorm published an exploit for a file disclosure vulnerability in the ABB Cylon Aspect.

Blackberry Exploit - SEC Consult published an exploit for an uninstall password bypass vulnerability in the Blackberry CylanceOPTICS product.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-d4d - subscription required.

Review – Public ICS Disclosures – Week of 8-17-24

This week we have eleven vendor disclosures from Bosch, Dassault Systèmes (3), HPE, Palo Alto Networks, Moxa, Panasonic, Rockwell, SonicWall, and Welotec. There are also three vendor updates from Cisco and HPE.

Advisories

Bosch Advisory - Boach published an advisory that describes a missing authentication vulnerability in their CPP13 and CPP14 IP cameras.

Dassault Systèmes Advisory #1 – Dassault Systèmes published an advisory that describes an open redirect vulnerability in their 3DSwymer product.

Dassault Systèmes Advisory #2 – Dassault Systèmes published an advisory that describes a reflected cross-site scripting vulnerability in their ENOVIA Collaborative Industry Innovator product.

Dassault Systèmes Advisory #3 – Dassault Systèmes published an advisory that describes an open redirect vulnerability in their 3DSwymer product.

HPE Advisory - HPE published an advisory that discusses nine vulnerabilities in their HPE SimpliVity AMD Servers.

Palo Alto Networks Advisory - Palo Alto Networks published an advisory that discusses OpenSSL’s exposure of sensitive information to an unauthorized actor vulnerability.

Moxa Advisory - Moxa published an advisory that discusses the regreSSHion vulnerability. Moxa provides a list of the affected products.

Panasonic Advisory - Panasonic acknowledges a stack-based buffer overflow vulnerability in their Control FPWIN Pro product.

Rockwell Advisory - Rockwell published an advisory that describes three vulnerabilities in their ThinManager ThinServer product.

SonicWall Advisory - SonicWall published an advisory that describes an improper access control vulnerability in their SonicOS product.

Welotec Advisory - CERT-VDE published an advisory that discusses the regreSSHion vulnerability.

UPDATES

Cisco Update #1 - Cisco published an update for their regreSSHion advisory that was originally published on July 2^nd, 2024 and most recently updated on August 2^nd, 2024.

Cisco Update #2 - Cisco published an update for their Blast-Radius advisory that was originally published on July 10^th, 2024, and most recently updated on August 9^th, 2024.

HPE Update - HPE published an update for their ProLiant DL/ML/XL, Synergy, MicroServer, and Edgeline Servers that was originally published on August 13^th, 2024.

 

For more information on these disclosures, including links to 3^rd party advisories and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-e17 - subscription required. 

Review – Public ICS Disclosures – Week of 8-3-24

This week we have 18 vendor disclosures from Bosch, Broadcom, B&R, Carrier, Hitachi (11), HPE (2), and SEL. There are also seven vendor updates from Broadcom (3), Cisco (2), HPE, and VMware. Finally, we have four researcher reports about vulnerabilities in products from Johnson Controls, Korenix, PLANET Technology, and Unitronics.

Advisories

Bosch Advisory - Bosch published an advisory that discusses four vulnerabilities (all with available exploits) in their DIVAR IP all-in-one Devices.

Broadcom Advisory - Broadcom published an advisory that discusses 22 vulnerabilities (11 with publicly available exploits) in their Brocade ASCG.

B&R Advisory - B&R published an advisory that discusses six vulnerabilities in their Automation Runtime product.

Carrier Advisory - Carrier published an advisory that discusses a supply chain attack that affected their LenelS2 NetBox products.

Hitachi Advisory #1 - Hitachi published an advisory that discusses an HTTP request/response smuggling vulnerability in their Cosminexus product.

Hitachi Advisory #2 - Hitachi published an advisory that discusses an incomplete cleanup vulnerability in their Automation Director, Infrastructure Analytics Advisor and Ops Center products.

Hitachi Advisory #3 - Hitachi published an advisory that describes an unquoted search path vulnerability in their Device Manager.

Hitachi Advisory #4 - Hitachi published an advisory that discusses six vulnerabilities (including three with publicly available exploits) in their Ops Center Analyzer viewpoint and Ops Center Viewpoint products.

Hitachi Advisory #5 - Hitachi published an advisory that discusses two vulnerabilities (one with publicly available exploits) in their Configuration Manager and Ops Center API Configuration Manager products.

Hitachi Advisory #6 - Hitachi published an advisory that discusses an XMM register corruption vulnerability in their Configuration Manager and Ops Center API Configuration Manager products.

Hitachi Advisory #7 - Hitachi published an advisory that discusses the Terrapin Attack vulnerability.

Hitachi Advisory #8 - Hitachi published an advisory that describes an EL injection vulnerability in their Tuning Manager product.

Hitachi Advisory #9 - Hitachi published an advisory that discusses six vulnerabilities in their Cosminexus Developer's Kit for Java and Hitachi Developer's Kit for Java products.

Hitachi Advisory #10 - Hitachi published an advisory that discusses six vulnerabilities in multiple products.

Hitachi Advisory #11 - Hitachi published an advisory that discusses 71 vulnerabilities in their Disk Array Systems.

HPE Advisory #1 - HPE published an advisory that describes a SMM lock bypass vulnerability in their ProLiant AMD Servers.

HPE Advisory #2 - HPE published an advisory that discusses the regreSSHion vulnerability. HPE reports that their Athonet products are affected.

SEL Advisory - SEL published a version update notice for their Compass product that reports that the new version includes cybersecurity enhancements.

Updates

Broadcom Update #1 - Broadcom published an update for their Privilege escalation using switch commands advisory that was originally published on September 13^th, 2022 and most recently updated on September 20^th, 2022.

Broadcom Update #2 - Broadcom published an update for their libxml2 advisory that was originally published on July 30^th, 2024.

Cisco Update #1 - Cisco published an update for their Blast-Radius advisory that was originally published on July 10^th, 2024 and most recently updated on August 2^nd, 2024.

Cisco Update #2 - Cisco published an update for their regreSSHion advisory that was originally published on July 2^nd, 2024 and most recently updated on July 26^th, 2024.

HPE Update - HPE published an update for their Fiber Channel and SAN Switches advisory that was originally published on August 1^st, 2024.

VMware Update - Broadcom published an update for their VMware Workspace ONE advisory that was originally published on April 6^th, 2024.

Researcher Reports

Johnson Controls Report - Nozomi Networks published a report describing five vulnerabilities in the Johnson Controls’ exacqVision Web Service.

Korenix Report - CyberDanube published a report that describes three vulnerabilities in the Korenix JetPort ethernet switch. An exploit was also published for the three vulnerabilities.

Planet Technology Report - IOActive published a report that describes three vulnerabilities in the PLANET IGS-4215-16T2S switch.

Unitronics Report - Claroty published a report that describes two vulnerabilities in Unitronics PLCs/HMI that have been exploited in the wild.

 

For more details about these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis – https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-bbf - subscription  required.

Review – Public ICS Disclosures – Week of 7-13-24

This week we have three vendor disclosures on the regreSSHion vulnerability from Bosch, Broadcom, HMS  We have 14 additional vendor disclosures from ABB, Dell, Fujitsu, Hitachi, HP (4), HPE (3), Rockwell (2), and Wireshark. There are also five vendor updates from BD and HPE (4). Finally, we have four researcher reports about vulnerabilities in products from Asus, Synology, and Unitronics (2).

RegreSSHion Advisories

Bosch published an advisory that lists affected products and fixed versions.

Broadcom published an advisory that lists the products that are not affected.

HMS published an advisory that lists the affected products and announces that fixes have been applied.

Advisories

ABB Advisory - ABB published an advisory that describes an unquoted search path or element vulnerability in their Mint Workbench product.

Dell Advisory - Dell published an advisory that lists a large number (nope, I am not counting them all) of 3^rd party vulnerabilities in their ThinOS product.

Fujitsu Advisory - JP-CERT published an advisory that describes a path traversal vulnerability in the Fujitsu Network Edgiot GW1500 product.

Hitachi Advisory - Hitachi published an advisory that discusses 42 vulnerabilities in their Disc Array Systems products.

HP Advisory #1 - HP published an advisory that describes a buffer overflow vulnerability in multiple desk top computers.

HP Advisory #2 - HP published an advisory that describes two privilege escalation vulnerabilities in their display control software.

NOTE: The HP Security Bulletins page lists two additional advisories (here and here), but neither page currently opens.

HPE Advisory #1 - HPE published an advisory that describes a remote bypass of a security restriction vulnerability in their 3PAR Service Processor Software.

HPE Advisory #2 - HPE published an advisory that discusses 17 vulnerabilities (one with known exploits) in their Unified OSS Console Assurance Monitoring (UOCAM) product.

HPE Advisory #3 - HPE published an advisory that discusses two vulnerabilities in their ProLiant DL/ML/XL, Synergy, Edgeline and Alletra Servers.

Rockwell Advisory #1 - Rockwell published an advisory that describes an improper input validation vulnerability in their SequenceManager Server.

Advisory #2 - Rockwell published an advisory that describes an improper input validation vulnerability in their 5015 – AENFTXT product.

Wireshark Advisory - Wireshark published an advisory that describes a packet injection vulnerability in their SPRT dissector product.

Updates

BD Update - BD published an update for their Third-Party ESET advisory that was originally published on March 29^th, 2024.

HPE Update #1 - HPE published an update for their Intel Thunderbolt Driver advisory that was originally published on May 14^th, 2024 and most recently updated on June 17^th, 2024.

HPE Update #2 - HPE published an update for their Intel PROSet/Wireless WiFi and Bluetooth advisory that was originally published on May 14^th, 2024 and most recently updated on June 17^th, 2024.

HPE Update #3 - HPE published an update for their Intel Chipset Device Software advisory that was originally published on June 28^th, 2024.

HPE Update #4 - HPE published an update for their Intel 2024.1 IPU - Chipset Software advisory that was originally published on March 13^th, 2024 and most recently updated on April 10^th, 2024.

Researcher Reports

Asus Report - BugProve published a report describing a stack-based buffer overflow vulnerability in the Asus RT-AC87U router.

Synology Report - Claroty published a report that describes a classic buffer overflow vulnerability in the Synology BC 500 IP camera.

Unitronics Reports - Claroty published two reports about individual vulnerabilities in the Unitronics Vision Plc.

 

For more information about these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-7-3e2 - subscription required.