Review – Public ICS Disclosures – Week of 1-17-26 – Part 1

We have a moderately busy disclosure week. For Part 1 we have 10 vendor disclosures from Beckhoff, Belden, B&R Automation (2), Carrier, Fujitsu, Hitachi, and HPE (3).

Advisories

Beckhoff Advisory - CERT-VDE published an advisory that describes a cross-site scripting vulnerability in their TwinCAT 3 HMI Server.

Belden Advisory - Belden published an advisory that discusses an improper handling of length parameter inconsistency vulnerability (that is listed in CISA’s KEV catalog) in their Connectivity Suite product.

B&R Advisory #1 - B&R published an advisory that describes an allocation of resources without limit or throttling vulnerability in their Automation Runtime products.

B&R Advisory #2 - B&R published an advisory that describes an improper certificate validation vulnerability in their Automation Studio product.

Carrier Advisory - Carrier published an advisory that describes a storing password in a recoverable format vulnerability in their Automated Logic WebCTRL and Carrier i-Vu products.

Fujitsu Advisory - CERT-JP published an advisory that describes an uncontrolled search path element vulnerability in the Fujitsu ServerView Agents for Windows.

Hitachi Advisory - Hitachi published an advisory that discusses 28 vulnerabilities in their Disk Array systems.

HPE Advisory #1 - HPE published an advisory that discusses 19 vulnerabilities (4 with publicly available exploits, 1 listed in KEV catalog) in their Telco Universal SLA Management product.

HPE Advisory #2 - HPE published an advisory that discusses an out-of-bounds rite vulnerability in their Telco IP product (ONMS Adapter).

HPE Advisory #3 - HPE published an advisory that describes a privilege escalation vulnerability in multiple HPE products utilizing the Alletra OS.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-407 - subscription required.

Review – Public ICS Disclosures – Week of 11-22-25 – Part 1

This week is a moderately busy disclosure week. For Part 1 we have 13 vendor disclosures from Carrier (3), Dassault Systems (2), Eaton, Hitachi, Janitza, Mitsubishi, Moxa (3), and Splunk.

Advisories

Carrier Advisory #1 - Carrier published an advisory that describes two vulnerabilities in the multiple Carrier and Automated Logic products.

Carrier Advisory #2 - Carrier published an advisory that describes an improper validation of array index vulnerability in multiple Carrier and Automated Logic products.

Carrier Advisory #3 - Carrier published an advisory that describes an improper input validation vulnerability in Carrier and Automated Logic Zone Controllers.

Dassault Advisory #1 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Product Manager.

Dassault Advisory #2 - Dassault published an advisory that that describes a cross-site scripting vulnerability in their DELMIA Service Process Engineer product.

Eaton Advisory - Eaton published an advisory that describes a path traversal vulnerability in their Galileo Software.

Hitachi Advisory - Hitachi published an advisory that discusses three vulnerabilities in multiple Hitachi products.

Janitza Advisory - CERT-VDE published an advisory that describes an improper validation of specified type of input vulnerability in the Janitza UMG 96-PA and UMG 96-PA-MID products.

Mitsubishi Advisory - Mitsubishi published an advisory that describes a cleartext storage of sensitive information vulnerability in their GX Works2 product.

Moxa Advisory #1 - Moxa published an advisory that describes a clickjacking vulnerability in their ioLogik E1200 Series and E 2200 series products.

Moxa Advisory #2 - Moxa published an advisory that describes a password autocompletion vulnerability in their ioLogik E1200 Series and E 2200 series products.

Moxa Advisory #3 - Moxa published an advisory that describes a cleartext transmission of sensitive information vulnerability in their ioLogik E1200 Series and E 2200 series products.

Splunk Advisory #1 - Splunk published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Add-On for Palo Alto Networks.

Splunk Advisory #2 - Splunk published an advisory that discusses three vulnerabilities (one with publicly available exploits) in their SOAR product.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-485 - subscription required.

Review – 4 Advisories and 2 Updates Published – 9-23-25

Today CISA’s NCCIC-ICS published four control system security advisories for products from Carrier (Viessmann), Schneider Electric, Mitsubishi Electric, and AutomationDirect. They also updated two advisories for products from Hitachi Energy.

Advisories

Carrier Advisory - This advisory describes two vulnerabilities in the Viessmann Vitogate 300.

Schneider Advisory - This advisory describes a link following vulnerability in the Schneider software update (SESU) service.

Mitsubishi Advisory - This advisory describes an improper handling of lengthy parameter inconsistency vulnerability in the Mitsubishi MELSEC-Q Series CPU modules.

NOTE: I briefly discussed this vulnerability on Sunday.

AutomationDirect Advisory - This advisory describes seven vulnerabilities in the AutomationDirect Click Plus programming software.

Updates

 Hitachi Energy Update #1 - This update provides additional information on the RTU500 Series advisory that was originally published on April 3^rd, 2025, and most recently updated on May 8^th, 2025.

Hitachi Energy Update #2 - This update provides additional information on the RTU500 Series advisory that was originally published on January 23, 2025.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-and-2-updates-published-be3 - subscription required.

Review – 7 Advisories and an Update Published – 2-20-25

Today CISA’s NCCIC-ICS published six control system security advisories for products from Elesta, Rapid Response Monitoring, Siemens, Carrier, and ABB (2), as well as a medical device security advisory for products from Medixant. They also updated a control system advisory for products from Mitsubishi.

Advisories

Elseta Advisory - This advisory describes an OS command injection vulnerability in the Elseta Vinci Protocol Analyzer.

Rapid Response Advisory - This advisory describes an authorization bypass through user controlled key vulnerability in the Rapid Response Monitoring My Security Account App.

Siemens Advisory - This advisory discusses a path traversal vulnerability in the Siemens SiPass integrated product.

Carrier Advisory - This advisory describes an uncontrolled search path element vulnerability in the Carrier Block Load HVAC load calculation program.

ABB Advisory #1 - This advisory describes three vulnerabilities with publicly available exploit in the ABB FLXeon Controllers.

Medixant Advisory - This advisory that describes an improper certificate validation vulnerability.

Updates

Mitsubishi Update - This update provides additional information on the CNC Series advisory that was originally published on October 17^th, 2024.

 

For more information on these advisories, including links to exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-an-update-published - subscription required.

Review – 7 Advisories Published – 11-21-24

Today, CISA’s NCCIC-ICS published seven control system security advisories for products from mySCADA, Schneider (4), CODESYS, and Carrier.

Advisories

mySCADA Advisory - This advisory describes five vulnerabilities in the mySCADA myPRO Manager products.

Schneider Advisory #1 - This advisory describes an uncontrolled resource consumption vulnerability in the Schneider PowerLogic PM5300 series energy meters.

Schneider Advisory #2 - This advisory describes a missing authentication vulnerability in the Schneider EcoStruxure IT Gateway.

Schneider Advisory #3 - This advisory describes an improper input validation vulnerability in the Schneider Modicon M340, MC80, and Momentum Unity M1E products.

CODESYS Advisory - This advisory describes an out-of-bounds read vulnerability in the CODESYS OSCAT Basic Library.

Carrier Advisory - This advisory describes two vulnerabilities in the Carrier (Automated Logic subsidiary) WebCTRL Premium Server.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-published-11-21-24 - subscription required.

Review – Public ICS Disclosure – 8-31-24 – Part 1

This week we have 29 vendor disclosures from Carrier, Dassault Systèmes (4), Eaton, HPE (2), Lenza, Moxa, Palo Alto Networks, QNAP (12), SEL (2), VMware, and Zyxel (2).

Advisories

Carrier Advisory - Carrier published an advisory that describes an unspecified ‘supply chain’ attack in their LenelS2 products.

Dassault Systèmes Advisory #1 - Dassault Systèmes published an advisory that describes a cross-site scripting vulnerability in their 3DExperience product.

Dassault Systèmes Advisory #2 - Dassault Systèmes published an advisory that describes a cross-site scripting vulnerability in their 3DExperience product.

Dassault Systèmes Advisory #3 - Dassault Systèmes published an advisory that describes a cross-site scripting vulnerability in their 3DExperience product.

Dassault Systèmes Advisory #4 - Dassault Systèmes published an advisory that describes a cross-site scripting vulnerability in their 3DExperience product.

Eaton Advisory - Eaton published an advisory that discusses the regreSSHion vulnerability.

HPE Advisory #1 - HPE published an advisory discusses ten vulnerabilities (five with publicly available exploits) in their UX Secure Shell product.

HPE Advisory #2 - HPE published an advisory that discusses nine vulnerabilities (four with publicly available exploits) in their Unified OSS Console Assurance Monitoring (UOCAM) product.

Lenza Advisory - CERT-VDE published an advisory that discusses an incorrect default permissions vulnerability (with a publicly available exploit) in their VisiWin 7 Install Directory application.

Moxa Advisory - Moxa published an advisory that discusses four vulnerabilities (three with publicly available exploits) in their OnCell 3120-LTE-1 Series advisory.

QNAP Advisory #1 - QNAP published an advisory that describes a cross-site scripting vulnerability in their Download Station product.

QNAP Advisory #2 - QNAP published an advisory that describes an improper certificate validation vulnerability in their QuMagie product.

QNAP Advisory #3 - QNAP published an advisory that describes three vulnerabilities in their QTS and QuTS hero products.

QNAP Advisory #4 - QNAP published an advisory that describes two OS command injection vulnerabilities in their QTS and QuTS hero products.

QNAP Advisory #5 - QNAP published an advisory that describes a cross-site scripting vulnerability in their QuLog Center product.

QNAP Advisory #6 - QNAP published an advisory that cross-site scripting vulnerability in their Helpdesk product.

QNAP Advisory #7 - QNAP published an advisory that describes two vulnerabilities in their QTS and QuTS hero products.

QNAP Advisory #8 - QNAP published an advisory that discusses an out-of-bounds write vulnerability in their QTS and QuTS hero products.

QNAP Advisory #9 - QNAP published an advisory that describes an OS command injection vulnerability in their Legacy Versions of QTS.

QNAP Advisory #10 - QNAP published an advisory that describes two vulnerabilities in their Video Station product.

QNAP Advisory #11 - QNAP published an advisory that describes an unquoted search path vulnerability in their QVR Smart Client product.

QNAP Advisory #12 - QNAP published an advisory that describes two cross-site scripting vulnerabilities in their Notes Station 3 product.

SEL Advisory #1 - SEL published a new version announcement that reported three cybersecurity enhancements in their SEL-5037 SEL Grid Configurator.

SEL Advisory #2 - SEL published a new version announcement that reported two cybersecurity enhancements in their SEL-5030 acSELerator QuickSet Software.

VMware Advisory - Broadcom published an advisory that describes an improper input validation vulnerability in the VMware Fusion product.

Zyxel Advisory #1 - Zyxel published an advisory that describes seven vulnerabilities in their firewall products.

Zyxel Advisory #2 - Zyxel published an advisory that describes an OS command injection vulnerability in their APs and security router devices.

 

For more information about these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/publish/posts/detail/148616972/share-center - subscription required.

Review – Public ICS Disclosures – Week of 8-3-24

This week we have 18 vendor disclosures from Bosch, Broadcom, B&R, Carrier, Hitachi (11), HPE (2), and SEL. There are also seven vendor updates from Broadcom (3), Cisco (2), HPE, and VMware. Finally, we have four researcher reports about vulnerabilities in products from Johnson Controls, Korenix, PLANET Technology, and Unitronics.

Advisories

Bosch Advisory - Bosch published an advisory that discusses four vulnerabilities (all with available exploits) in their DIVAR IP all-in-one Devices.

Broadcom Advisory - Broadcom published an advisory that discusses 22 vulnerabilities (11 with publicly available exploits) in their Brocade ASCG.

B&R Advisory - B&R published an advisory that discusses six vulnerabilities in their Automation Runtime product.

Carrier Advisory - Carrier published an advisory that discusses a supply chain attack that affected their LenelS2 NetBox products.

Hitachi Advisory #1 - Hitachi published an advisory that discusses an HTTP request/response smuggling vulnerability in their Cosminexus product.

Hitachi Advisory #2 - Hitachi published an advisory that discusses an incomplete cleanup vulnerability in their Automation Director, Infrastructure Analytics Advisor and Ops Center products.

Hitachi Advisory #3 - Hitachi published an advisory that describes an unquoted search path vulnerability in their Device Manager.

Hitachi Advisory #4 - Hitachi published an advisory that discusses six vulnerabilities (including three with publicly available exploits) in their Ops Center Analyzer viewpoint and Ops Center Viewpoint products.

Hitachi Advisory #5 - Hitachi published an advisory that discusses two vulnerabilities (one with publicly available exploits) in their Configuration Manager and Ops Center API Configuration Manager products.

Hitachi Advisory #6 - Hitachi published an advisory that discusses an XMM register corruption vulnerability in their Configuration Manager and Ops Center API Configuration Manager products.

Hitachi Advisory #7 - Hitachi published an advisory that discusses the Terrapin Attack vulnerability.

Hitachi Advisory #8 - Hitachi published an advisory that describes an EL injection vulnerability in their Tuning Manager product.

Hitachi Advisory #9 - Hitachi published an advisory that discusses six vulnerabilities in their Cosminexus Developer's Kit for Java and Hitachi Developer's Kit for Java products.

Hitachi Advisory #10 - Hitachi published an advisory that discusses six vulnerabilities in multiple products.

Hitachi Advisory #11 - Hitachi published an advisory that discusses 71 vulnerabilities in their Disk Array Systems.

HPE Advisory #1 - HPE published an advisory that describes a SMM lock bypass vulnerability in their ProLiant AMD Servers.

HPE Advisory #2 - HPE published an advisory that discusses the regreSSHion vulnerability. HPE reports that their Athonet products are affected.

SEL Advisory - SEL published a version update notice for their Compass product that reports that the new version includes cybersecurity enhancements.

Updates

Broadcom Update #1 - Broadcom published an update for their Privilege escalation using switch commands advisory that was originally published on September 13^th, 2022 and most recently updated on September 20^th, 2022.

Broadcom Update #2 - Broadcom published an update for their libxml2 advisory that was originally published on July 30^th, 2024.

Cisco Update #1 - Cisco published an update for their Blast-Radius advisory that was originally published on July 10^th, 2024 and most recently updated on August 2^nd, 2024.

Cisco Update #2 - Cisco published an update for their regreSSHion advisory that was originally published on July 2^nd, 2024 and most recently updated on July 26^th, 2024.

HPE Update - HPE published an update for their Fiber Channel and SAN Switches advisory that was originally published on August 1^st, 2024.

VMware Update - Broadcom published an update for their VMware Workspace ONE advisory that was originally published on April 6^th, 2024.

Researcher Reports

Johnson Controls Report - Nozomi Networks published a report describing five vulnerabilities in the Johnson Controls’ exacqVision Web Service.

Korenix Report - CyberDanube published a report that describes three vulnerabilities in the Korenix JetPort ethernet switch. An exploit was also published for the three vulnerabilities.

Planet Technology Report - IOActive published a report that describes three vulnerabilities in the PLANET IGS-4215-16T2S switch.

Unitronics Report - Claroty published a report that describes two vulnerabilities in Unitronics PLCs/HMI that have been exploited in the wild.

 

For more details about these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis – https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-bbf - subscription  required.

Review – 6 Advisories and 1 Update Published – 5-30-24

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Westermo, Inosoft, Fuji Electric, and Carrier. They also updated an advisory for products from Mitsubishi Electric. Finally, they published two medical devices security advisories for products from Baxter.

NIST published a brief update on the status of the problems with the National Vulnerability Database (NVD).

Advisories

Westermo Advisory - This advisory describes two vulnerabilities in the Westermo EDW-100 Serial to Ethernet converter.

Inosoft Advisory - This advisory describes an incorrect default permissions vulnerability with known exploit in the Inosoft VisiWin HMI.

Fuji Advisory - This advisory describes two vulnerabilities in the Fuji Monitouch V-SFT screen configuration software.

Carrier Advisory - This advisory describes three vulnerabilities in the Carrier LenelS2 NetBox access control and event monitoring system.

Baxter Advisory #1 - This advisory describes a use of default cryptographic key vulnerability in the Baxter Welch Allyn Connex Spot Monitor.

Baxter Advisory #2 - This advisory describes an insufficiently protected credentials vulnerability in the Baxter Welch Allyn Configuration Tool.

Updates

Mitsubishi Update - This advisory provides additional information on the MELSEC iQ-R advisory that was originally published on December 22^nd, 2022 and most recently updated on December 12^th, 2023.

NVD Update

NVD Database Problem Update - Yesterday NIST updated the status of the problem with NVD maintenance issues.

For more information no these advisories, including links to exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-1-update-published-fa6 - subscription required.

Review – Public ICS Disclosures – Week of 6-10-23 – Part 1

This week we have thirteen vendor disclosures from Carrier, HPE (2), Insyde (3), Palo Alto Networks (3), Phoenix Contact, QNAP, Riello, and VMware. There is also an update from HPE.

In Part 2, I will look at advisories and updates for products from FortiGuard, Schneider and Siemens.

Advisories

Carrier Advisory - Carrier published an advisory that describes an authorization bypass vulnerability in their g MASmobile Classic application.

HPE Advisory #1 - HPE published an advisory that describes a privileged information disclosure vulnerability in their Insight Remote Support (I-RS) product.

HPE Advisory #2 - HPE published an advisory that discusses 19 vulnerabilities in their Integrity MC990 X Server RMC firmware.

Insyde Advisory #1 - Insyde published an advisory that describes a memory leak vulnerability in their CapsuleIFWUSmm driver.

Insyde Advisory #2 - Insyde published an advisory that discusses an empty TPM platform authorization vulnerability.

Insyde Advisory #3 - Insyde published an advisory that describes a security boundary bypass vulnerability in the InsydeH2O UEFI.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory that describes a cross-site scripting vulnerability in their PAN-OS product.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory that describes a privilege escalation vulnerability in their GlobalProtect App.

Palo Alto Networks Advisory #3 - Palo Alto Networks published an advisory that discusses the MOVEit Vulnerabilities.

Phoenix Contact Advisory - Phoenix Contact published an advisory that discusses two vulnerabilities in their FL MGUARD family.

QNAP Advisory - QNAP published an advisory that discusses four vulnerabilities in multiple products.

Riello Advisory - Incibe-CERT published an advisory that describes a CSRF token validation vulnerability in the Riello UPS Netman-204 network adapter.

VMware Advisory - VMware published an advisory that describes an authentication bypass vulnerability in their Tools product.

Updates

HPE Update - HPE published an update for their NonStop servers advisory that was originally published on March 16^th, 2023.

 

For more details about these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-7ce - subscription required.

Review – Public ICS Disclosures – Week of 3-11-23 – Part 1

This week we have nine vendor disclosures from Aruba Networks, Carrier, Contec, Hitachi Energy, HPE (2), InHand Networks, Moxa, and Phoenix Contact. There are five vendor updates from HPE (4) and Moxa. Finally, we have three exploits for products from Eaton, Riello, and Fortinet.

In Part 2 this week I will look at disclosures from Schneider and Siemens.

Advisories

Aruba Advisory - Aruba published an advisory that describes eight vulnerabilities in their ClearPass Policy Manager program.

Carrier Advisory - Carrier published an advisory that discusses a server side request forgery vulnerability in their g LenelS2 supported platform.

Contec Advisory - Contec published an advisory that describes three vulnerabilities in their CONPROSYS M2M Gateway Series, M2M Controller Series products.

Hitachi Energy Advisory - Hitachi published an advisory that discusses a permissions, privileges, and access control vulnerability in their MicroSCADA Pro/X SYS600 Products.

HPE Advisory #1 - HPE published an advisory that discusses eight vulnerabilities in their NonStop servers.

HPE Advisory #2 - HPE published an advisory that describes a cross-site scripting vulnerability in their Integrated Lights-Out products.

InHand Advisory - InHand published an advisory that describes five vulnerabilities in their InRouter615-S industrial routers.

Moxa Advisory - Moxa published an advisory that describes two improper certificate validation vulnerabilities in their NPort 6000 Series and Windows Driver Manager products.

Phoenix Contact Advisory - Phoenix Contact published an advisory that discusses five vulnerabilities in their ENERGY AXC PU product.

Updates

HPE Update #1 - HPE published an update for their FlexNetwork and FlexFabric Switches advisory that was originally published on July 30^th, 2022.

HPE Update #2 - HPE published an update for their OneView for VMware vCenter advisory that was originally published on February 17^th, 2023.

HPE Update #3 - HPE published an update for their ProLiant Moonshot Servers advisory that was originally published on November 8^th, 2022.

HPE Update #4 - HPE published an update for their ProLiant BL/DL/ML Servers advisory that was originally published on November 8^th, 2022.

Moxa Update - Moxa published an update for their UC Series advisory that was originally published on November 29^th, 2022 and most recently updated on February 9^th, 2023.

Exploits

Eaton Exploit - Yehia Elghaly published an exploit for a denial-of-service vulnerability in the Eaton Webpower UPS.

Reillo Exploit - Ricardo Jose Ruiz Fernandez published an exploit for shell bypass vulnerability in the Riello UPS system.

Fortinet Exploit - Jheysel-r7, Zach Hanley, and Gwendal Guegniaud published a Metasploit module for an externally controlled reference to a resource in another sphere vulnerability in the FortiNAC.

 

For more details about these disclosures, including links to third-party advisories, researcher reports and summary of changes made in updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-3-d50  - subscription required.

Review – Public ICS Disclosures – Week of 1-21-23

This week we have an OpenSSL 3.0 advisory from Dell. We have seven vendor disclosures from Carrier, Contec, GE Grid Solutions, Meinberg, Omron, and PulseSecure (2). We also have three vendor updates from CODESYS, HPE, and PcVue. Finally, we have 16 researcher reports for products from Siretta (14), Zyxel, and Delta Electronics.

Open SSL 3.0 Advisories

Dell published an advisory that discusses the OpenSSL 3.0 vulnerabilities.

Vendor Advisories

Carrier Advisory - Carrier published an advisory that discusses multiple authentication bypass vulnerabilities in their WebCTRL® and i-Vu® software.

Contec Advisory - Contec published an advisory that describes an SQL injection vulnerability in the Contec CONPROSYS HMI System.

GE Grid Solutions Advisory - GE Grid Solutions published an advisory for their DS Agile Distributed Control System.

Meinberg Advisory - Meinberg published an advisory that discusses eight vulnerabilities in their LANTIME product.

Omron Advisory - JP Cert published an advisory that describes an improper restriction of an XML entity reference vulnerability in the OMRON CX-Motion Pr.

PulseSecure Advisory #1 - PulseSecure published an advisory that discusses a use-after-free vulnerability.

PulseSecure Advisory #2 - PulseSecure published an advisory that discusses a double free vulnerability.

Vendor Updates

CODESYS Update - CODESYS published an update for their Control V3 communication server advisory that was originally published on November 22nd, 2022 and most recently updated on December 14^th, 2022.

HPE Update - HPE published an update for their IceWall advisory that was originally published on March 9^th, 2018 and most recently updated on May 26^th, 2021.

PcVue Update - PcVue published an update for their email and SMS accounts advisory that was originally published on November 25^th, 2022 and most recently updated on December 20^th, 2022.

NOTE: NCCIC-ICS has not updated their advisory (ICSA-22-354-03) to reflect this information.

Researcher Reports

Siretta Report #1 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing 46 stack-based buffer overflow vulnerabilities.

Siretta Report #2 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a directory traversal vulnerability.

Siretta Report #3 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing four command injection vulnerabilities.

Siretta Report #4 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a heap-based buffer overflow vulnerability.

Siretta Report #5 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a file write vulnerability.

Siretta Report #6 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a leftover debug code vulnerability.

Siretta Report #7 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #8 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #9 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #10 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a stack-based buffer overflow vulnerability.

Siretta Report #11 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a directory traversal vulnerability.

Siretta Report #12 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #13 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a directory traversal vulnerability.

Siretta Report #14 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a stack-based buffer overflow vulnerability.

Zyxel Report - Positive Technologies published a report describing an improper check for unusual or exceptional conditions vulnerability in Zyxel switches.

Delta Report - Tenable published a report describing a privilege escalation vulnerability in the Delta Electronics InfraSuite Device Master.

 

For more details about these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-e09 - subscription required.

Review – Public ICS Disclosures – Week of 11-26-22

This week we have one OpenSSL 3.0 vendor advisory from Eaton. There are fourteen other vendor advisories from Aruba Networks, Broadcom, Carrier, CODESYS, Festo (2), Hitachi, Honeywell (2), HPE, Moxa (2), Rockwell Automation, and VMware. We also have two vendor updates from ABB and HPE. There are also three researcher reports for products from Festo and Delta Electronics (2). Finally, we have an exploit for products from Belden.

OpenSSL 3.0 Advisories

Eaton published an OpenSSL 3.0 advisory. Eaton reports that none of their products are affected.

Vendor Advisories

Aruba Advisory - Aruba published an advisory that describes three broken access control vulnerabilities in their AirWave Management Platform.

Broadcom Advisory - Broadcom published an advisory that discusses two vulnerabilities in their Active Support Connectivity Gateway.

Carrier Advisory - Carrier published an advisory that discusses an improper authentication vulnerability in their LenelS2’s OnGuard product.

CODESYS Advisory - CODESYS published an advisory that describes an inadequate encryption strength vulnerability in their V3 boot application.

Festo Advisory #1 - CERT-VDE published an advisory that discusses two vulnerabilities in multiple Festo products.

Festo Advisory #2 - CERT-VDE published an advisory that describes an insufficient technical documentation vulnerability in multiple Festo products.

Hitachi Advisory - Hitachi published an advisory that discusses 36 vulnerabilities in their Disk Array products.

Honeywell Advisory #1 - Honeywell published an end-of-life notice for their V-Plex Dual Tech Motion Sensor.

Honeywell Advisory #2 - Honeywell published an end-of-life notice for their Pro-Watch® 4.5 product effective May 31^st, 2023.

HPE Advisory - HPE published an advisory that discusses five vulnerabilities in their UX Apache Web Server.

Moxa Advisory #1 - Moxa published an advisory that describes an improper input validation vulnerability in their Secure Router, EDR and TN Series.

Moxa Advisory #2 - Moxa published an advisory that describes an improper input validation vulnerability in their Secure Router, EDR and TN Series.

Rockwell Advisory - Rockwell published an advisory that describes a clear-text transmission of sensitive data vulnerability in their FactoryTalk LiveData Communication Module.

VMware Advisory - VMware published an advisory that describes a denial-of-service vulnerability in their Tools for Windows products.

Vendor Updates

ABB Update - ABB published an update for their Ability zenon, ZEE600, ZEE600C Log Server advisory that was originally published on July 26^th, 2022.

HPE Update - HPE published an update for their OneView advisory that was originally published on July 20^th, 2022.

Researcher Reports

OT:ICEFALL Report Update - Forescout’s Vedere Labs published an update for their OT:ICEFALL report identifying three new vulnerabilities.

Delta Report #1 - CyberDanube published a report describing two vulnerabilities in the Delta DX-2100-L1-CN. The report includes proof-of-concept code.

Delta Report #2 - CyberDanube published a report describing a command injection vulnerability in the Delta DVW-W02W2-E2.

Exploits

Belden Exploit - T Weber published an exploit for a command injection vulnerability in the Hirschmann (Belden) BAT-C2 8.8.1.0R8.

 

For more details about these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-a4c - subscription required.

Review – Public ICS Disclosures – Week of 11-5-22 – Part 1 -

This is a busy Saturday after the 2^nd Tuesday. For Part 1 this week we have five OpenSSL 3.0 vendor disclosures from Carrier, Draeger, Eurotech, Palo Alto Networks, and QNAP.  There are 23 other vendor disclosures from Aiphone, Belden, Broadcom (9), Carrier, Fujitsu, GE Gas Power, HP, and HPE (8).

OpenSSL 3.0 Disclosures

Carrier published an OpenSSL 3.0 advisory. Carrier reports that no products are affected.

Draeger published an OpenSSL 3.0 advisory. Draeger reports that their medical devices are not affected.

Eurotech published an OpenSSL 3.0 advisory. Eurotech reports that none of their products are affected.

Palo Alto Networks updated their OpenSSL 3.0 advisory. They report that none of their products are affected.

QNAP published an OpenSSL 3.0 advisory. QNAP reports that their products are not affected.

Other Vendor Disclosures

Aiphone Advisory - Aiphone published an advisory that describes an information disclosure vulnerability in their GT Entrance Station product.

Belden Advisory - Belden published an advisory that discusses two unauthorized access vulnerabilities in their Provise and Hirschmann network management products.

Broadcom Advisory #1 - Broadcom published an advisory that discusses an off-by-one error vulnerability in their Brocade SANnav.

Broadcom Advisory #2 - Broadcom published an advisory that discusses an infinite loop vulnerability in undisclosed products (probably Brocade SANnav).

Broadcom Advisory #3 - Broadcom published an advisory that discusses an out-of-bounds write in their Brocade SANnav product.

Broadcom Advisory #4 - Broadcom published an advisory that describes an improper storage of sensitive information vulnerability in their Brocade SANnav product.

Broadcom Advisory #5 - Broadcom published an advisory that describes an information exposure vulnerability in their Brocade SANnav product.

Broadcom Advisory #6 - Broadcom published an advisory that describes an information exposure vulnerability in their Brocade SANnav product.

Broadcom Advisory #7 - Broadcom published an advisory that describes weak key exchange vulnerability in their Brocade SANnav product.

Broadcom Advisory #8 - Broadcom published an advisory that describes an information exposure vulnerability in their Brocade SANnav product.

Broadcom Advisory #9 - Broadcom published an advisory that describes a remote code execution vulnerability in their Brocade Fabric OS.

Carrier Advisory - Carrier published an advisory that discusses the Text4Shell vulnerability.

Fujitsu Advisory - Fujitsu published an advisory that discusses eight vulnerabilities in a variety of Fujitsu products.

GE Advisory - GE Gas Power published an advisory that discusses “Malware Persistence in VMWare ESXi Hypervisor”.

HP Advisory - HP published an advisory that describes a privilege escalation vulnerability in the BIOS for a number of HP products.

HPE Advisory #1 - HPE published an advisory that discusses an authentication bypass vulnerability in their B-series SAN Switches.

HPE Advisory #2 - HPE published an advisory that discusses five vulnerabilities in their B-Series SANnav Management Portal.

HPE Advisory #3 - HPE published an advisory that discusses an improper input validation vulnerability in their Synergy Servers.

HPE Advisory #4 - HPE published an advisory that discusses two vulnerabilities in their ProLiant Moonshot Servers.

HPE Advisory #5 - HPE published an advisory that discusses six vulnerabilities in their ProLiant DL/ML Servers.

HPE Advisory #6 - HPE published an advisory that discusses two vulnerabilities in their ProLiant BL/DL/ML Servers.

HPE Advisory #7 - HPE published an advisory that discusses an improper input validation vulnerability in their Apollo Servers.

HPE Advisory #8 - HPE published an advisory that discusses an improper input validation vulnerability in their StoreEasy Servers.

 

For more details about these advisories, including links to third-party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-b51 - subscription required.

Review – 2 Advisories Published – 6-2-22

 

Today, CISA’s NCCIC-ICS published two control system security advisories for products from Illumina and Carrier.

Illumina Advisory - This advisory describes five vulnerabilities in the Illumina Local Run Manager software.

Carrier Advisory - This advisory describes eight vulnerabilities in the Carrier HID Mercury access panels (sold by LenelS2 subsidiary).

Commentary

Quality control testing in both chemical and biological production facilities can provide a unique point of access to control system networks. While today’s Illumina vulnerabilities are directly related to software that controls laboratory equipment, today’s modern quality control laboratories maintain a network of connected instruments and instrument control systems to manage the testing and reporting of both in-process and final-product quality testing. Reports on that testing are frequently shared with customers, R&D, and sales personnel, frequently by email or shared data bases. Furthermore, the more integrated the manufacturing environment, the more likely it is that there is some network linkage between the QA lab and the production floor. Thus, a vulnerability in a piece of analytical equipment may ultimately provide access to control system networks.

 

For more information on these advisories, and a Down the Rabbit Hole report on a unique vulnerability reporting format, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-published-6-2-22 - subscription required.

Review – 5 Advisories and 1 Update Published – 4-19-22

Today, CISA’s NCCIC-ICS published five control system security advisories for products from Elcomplus (2), FANUC, and Carrier (2). They also updated their advisory for multiple RTOS products.

Elcomplus Advisory #1 - This advisory describes five vulnerabilities in the Elcomplus SmartPPT SCADA Server integrated voice and data dispatch software.

Elcomplus Advisory #2 - This advisory describes four vulnerabilities in the Elcomplus SmartPPT SCADA integrated voice and data dispatch software.

FANUC Advisory - This advisory describes five vulnerabilities in the FANUC ROBOGUIDE simulation platform software suite for FANUC Robots.

NOTE: On April 9^th, 2022, I briefly reported (subscription required) on a FANUC advisory that reported two of the above CVE’s (CVE-2021-38483 and CVE-2021-43986).

Carrier Advisory - This advisory describes an open redirect vulnerability in the Automated Logic (subsidiary of Carrier) WebCtrl Server building automation software products.

Carrier Advisory #2 - This advisory describes two vulnerabilities in the Interlogix (subsidiary of Carrier) Hills ComNav remote access integration modules for the Hills Reliance security alarm system.

NOTE: The Carrier advisory lists two additional vulnerabilities.

Multiple RTOS Update - This update provides additional information on an advisory that was originally published on April 29^th, 2021 and most recently updated on November 30^th, 2021.

NOTE: I briefly reported on these three advisories on December 18^th, 2021.

 

For more details about these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-1-update-published-995 - subscription required.

Review - Public ICS Disclosures – Week of 4-2-22 – Part 1

A busy week with lots of SpringShell and DirtyPipe disclosures, so there will be two parts this week. In this part we have 24 vendor disclosures from Aruba, Barco, Bentley (8), Braun, Broadcom (3), Carrier, Weidmueller, WAGO, CODESYS (6), and FANUC.

Aruba Advisory - Aruba published an advisory discussing the SpringShell vulnerabilities.

Barco Advisory - Barco published an advisory discussing the DirtyPipe vulnerability.

Bentley Advisory #1 - Bentley published an advisory describing two use after free vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Bentley Advisory #2 - Bentley published an advisory describing three stack-based buffer overflow vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Bentley Advisory #3 - Bentley published an advisory describing an out-of-bounds write vulnerability in the Bentley MicroStation and MicroStation-based applications.

Bentley Advisory #4 - Bentley published an advisory describing eleven file parsing vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Bentley Advisory #5 - Bentley published an advisory describing two out-of-bounds read vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Bentley Advisory #6 - Bentley published an advisory describing five out-of-bounds vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Bentley Advisory #7 - Bentley published an advisory describing four out-of-bounds read vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Bentley Advisory #8 - Bentley published an advisory describing two unitialized variable vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Braun Advisory - Braun published an advisory discussing the Infusion Pump Vulnerabilities article by Palo Alto Networks.

Broadcom Advisory #1 - Broadcom published an advisory discussing one of the SpringShell vulnerabilities.

Broadcom Advisory #2 - Broadcom published an advisory describing the other SpringShell vulnerability.

Broadcom Advisory #3 - Broadcom published an advisory discussing an older Spring Framework vulnerability reanimated by the SpringShell vulnerability.

Carrier Advisory - Carrier published an advisory discussing the SpringShell vulnerabilities.

Weidmueller Advisory - CERT-VDE published an advisory discussing nine vulnerabilities in two products using Modbus TCP/RTU Gateways.

WAGO Advisory - CERT-VDE published an advisory discussing the DirtyPipe vulnerability in several WAGO products.

CODESYS Advisory #1 - CODESYS published an advisory describing an exposure of resource to wrong sphere vulnerability in the CODESYS Control V3 products.

CODESYS Advisory #2 - CODESYS published an advisory describing an incorrect permission assignment for a critical resource vulnerability in the CODESYS SysDrv3S.sys driver.

CODESYS Advisory #3 - CODESYS published an advisory describing a small space of random values vulnerability in CODESYS V3 products using the CODESYS communication protocol.

CODESYS Advisory #4 - CODESYS published an advisory describing an incorrect user management vulnerability in the  CODESYS Control V3 online user management applications.

CODESYS Advisory #5 - CODESYS published an advisory describing two vulnerabilities in CODESYS V3 products containing a CODESYS communication server.

CODESYS Advisory #6 - CODESYS published an advisory describing a buffer over read vulnerability in the CODESYS V3 web server.

 

For more details on these disclosures, including links to 3^rd party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/22-part-1 - subscription required.

Review – Public ICS Disclosures – Week of 3-26-22 – Part 1

Another busy week. This week, for Part 1 we have fifteen vendor disclosures from Bosch, Braun, Broadcom (2), Carrier, GE Gas Power, Hitachi, Hitachi Energy, HPE, Mitsubishi, Palo Alto Networks (2), Philips (2), and Phoenix Contact.

Bosch Advisory - Bosch published an advisory describing two stack-based buffer overflows in the recovery image process in their CPP Firmware.

Braun Advisory - Braun published an advisory discussing the PaloAlto Networks report on infusion pump vulnerabilities.

Broadcom Advisory #1 - Broadcom published an advisory discussing the 23 reported vulnerabilities in Insyde's H2O UEFI firmware.

Broadcom Advisory #2 - Broadcom published an advisory describing an inadequate cryptographic key implementation vulnerability in their Brocade Fabric OS (FOS) for older generation platforms.

Carrier Advisory - Carrier published an advisory discussing the LAPSUS$ attack on Octa.

GE Advisory - GE published an advisory discussing the SpringShell vulnerabilities.

Hitachi Advisory - Hitachi published an advisory discussing 31 vulnerabilities in their Disk Array products.

Hitachi Energy Advisory - Hitachi Energy published an advisory discussing the Spring4Shell vulnerabilities.

HPE Advisory - HPE published an advisory describing four vulnerabilities in the HPE OneView product.

Mitsubishi Advisory - Mitsubishi published an advisory discussing the Log4Shell vulnerabilities in their CC-Link IE TSN Configurator.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory discussing an infinite loop vulnerability in their PAN-OS products.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory discussing the Spring4Shell vulnerabilities.

Philips Advisory #1 - Philips published an advisory discussing six vulnerabilities in their IntelliVue XDS and VuePACS products.

Philips Advisory #2 - Philips published an advisory discussing an authentication bypass by spoofing vulnerability.

Phoenix Contact Advisory - Phoenix Contact published and advisory discussing 15 vulnerabilities (2 with known exploits) in their PROFINET SDK.

 

For more information on these disclosures, including links to researcher reports, 3^rd-party vendor advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-3-113 - subscription required.