Review – Public ICS Disclosures – Week of 6-13-24

This week we have 12 vendor disclosures from Broadcom, Dahua, Hitachi (4), HP, HPE, Insyde, SonicWall, Three R Solutions, and VMware. There are two vendor updates from Palo Alto Networks and Synology. We also have two researcher reports that describe vulnerabilities in products from Synology and Korenix.

Advisories

Broadcom Advisory - Broadcom published an advisory that discusses an out-of-bounds write vulnerabilities that is listed in the CISA Known Exploited Vulnerabilities Catalog in multiple Brocade products.

Dahua Advisory - JP-CERT published an advisory that describes an authentication bypass vulnerability in multiple Dahua products.

Hitachi Advisory #1 - Hitachi published an advisory that describes two vulnerabilities in their Device Manager.

Hitachi Advisory #2 - Hitachi published an advisory that discusses an allocation of resources without throttling or limits vulnerability in their Tuning Manager product.

Hitachi Advisory #3 - Hitachi published an advisory that discusses an out-of-bounds write vulnerability in multiple Hitachi products.

Hitachi Advisory #4 - Hitachi published an advisory that describes an incorrect default permissions vulnerability in their Tuning Manager product.

HP Advisory - HP published an advisory that discusses seven vulnerabilities in multiple HP products.

HPE Advisory - HPE published an advisory that discusses eight vulnerabilities in their  HP-UX Apache Web Server products.

Insyde Advisory - Insyde published an advisory that discusses nine vulnerabilities in their EDK2 NetworkPkg IP stack

SonicWall Advisory - SonicWall published an advisory that describes a stack-based buffer overflow vulnerability in their Capture Client and NetExtender Client Windows products.

Three R Solutions Advisory - JP-CERT published an advisory that describes an insufficient technical documentation vulnerability in the Three R Solutions Thermal camera TMC series products.

VMware Advisory - VMware published an advisory that describes a missing access control vulnerability in their Aria Automation products.

Updates

Palo Alto Networks Update - Palo Alto Networks published an update for their Terrapin-Attack vulnerability that was originally published on January 8^th, 2024.

Synology Update - Synology published an update for their DiskStation Manager advisory that was originally published on January 9^th, 2024.

Researcher Reports

Synology Report - Claroty published a report describing an inadequate data validation vulnerability in the Synology RT6600ax routers.

Korenix Report - CyberDanube published a report describing two vulnerabilities in the Korenix JetNet Series industrial switch.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-7a6 - subscription required. 

Review – Public ICS Disclosures – Week of 2-4-23

This week we have eleven vendor disclosures from ABB, Baicells, Dahua, Palo Alto Networks (5), Ruckus, and Zyxel Networks (2). We also have three vendor updates from CONTEC, HPE, and Moxa. Finally, we have thirteen researcher reports on products from Siemens, and Open Design Alliance (12).

NOTE: There have been problems with the NIST NVD CVE listings this morning. They have been slow to load or have not been found. Hopefully this will be corrected in the near future.

Vendor Disclosures

Baicells Advisory - Baicells published an advisory that describes a cross-site scripting vulnerability in their Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices.

Dahua Advisory - Dahua published an advisory that describes an unauthorized modification of device timestamp vulnerability in some of their embedded products.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory that discusses an improper privilege management vulnerability in SUDO.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory that discusses the OpenSSL vulnerabilities disclosed Feb 7, 2023.

Palo Alto Networks Advisory #3 - Palo Alto Networks published an advisory that describes a protection mechanism failure vulnerability in their Cortex XDR agent.

Palo Alto Networks Advisory #4 - Palo Alto Networks published an advisory that describes an information disclosure vulnerability in their Cortex XDR agent.

Palo Alto Networks Advisory #5 - Palo Alto Networks published an advisory that describes a file disclosure vulnerability in their Cortex XSOAR server.

Ruckus Advisory - Ruckus published an advisory that describes a cross-site request forgery vulnerability in multiple products using their AP Web application.

NOTE: Multiple end-of-life products are listed as being affected by this vulnerability.

Zyxel Advisory #1 - Zyxel published an advisory that describes a command injection vulnerability in their firewalls.

Zyxel Advisory #2 - Zyxel published an advisory that describes an improper check for unusual or exceptional conditions vulnerability in their Aps.

Vendor Updates

CONTEC Update - JP CERT published an update for their Solar View Compact advisory that was originally published on May 26^th, 2022 and most recently updated on December 13^th, 2022.

HPE Update - HPE published an update for their OneView advisory that was originally published on January 31^st, 2023.

Moxa Update - Moxa published an update for their UC Series advisory that was originally published on November 29^th, 2023.

NOTE: NCCIC-ICS has not updated their advisory (ICSA-22-333-04) for this new information.

Researcher Reports

Siemens Report - Otorio published a report describing two vulnerabilities in the Siemens Automation License Manager.

ODA Report #1 - The Zero Day Initiative published a report that describes a memory corruption vulnerability in the ODA Drawing SDK.

ODA Report #2 - ZDI published a report that describes a memory corruption vulnerability in the ODA Drawing SDK.

ODA Report #3 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report # 4 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #5 - ZDI published a report that describes a heap-based buffer overflow vulnerability in the ODA Drawing SDK.

ODA Report #6 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #7 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #8 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report # 9 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #10 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #11 - ZDI published a report that describes a heap-based buffer overflow vulnerability in the ODA Drawing SDK.

ODA Report #12 - ZDI published a report that describes a use-after-free vulnerability in the ODA Drawing SDK.

 

For more details about these disclosures, including links to third-party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-6e9 - subscription required.

Review – Public ICS Disclosures – Week of 12-17-22

This week we have an OpenSSL 3.0 disclosure from Palo Alto Networks. There are nine vendor disclosures from Dahua, Dell, DIGI, Hikvision, HPE, Microchip, Motorola Solutions, TandD, and Western Digital. Finally, there is a vendor update from Siemens.

OpenSSL. 3.0

Palo Alto Networks published an advisory discussing the OpenSSL 3.0 vulnerabilities.

Vendor Disclosures

Dahua Advisory - Dahua published an advisory that describes twelve vulnerabilities in a variety of Dahua products.

Dell Advisory - Dell published an advisory that describes nine vulnerabilities (includes 3 third-party vulnerabilities) in their Wyse Management Suite. 

DIGI Advisory - DIGI published an advisory that discusses the FragAttack vulnerabilities.

Hikvision Advisory - Hikvision published an advisory that describes an access control vulnerability in their wireless bridge products.

HPE Advisory #1 - HPE published an advisory that directory traversal vulnerability in their OfficeConnect 1820, and 1850 Switch Series.

HPE Advisory #2 - HPE published an advisory that describes a data injection vulnerability in their Superdome Flex and Superdome Flex 280 Servers.

Microchip Advisory - Microchip published an advisory that discusses the Blue's Clues vulnerabilities.

NOTE: Watch Blue’s Clues (sorry, I could not help myself), cute name and everything. It looks like this will be a major issue for Bluetooth enabled devices, particularly medical devices.

Motorola Advisory - Motorola published an advisory discussing the Fortinet buffer overflow vulnerability.

TandD Advisory - TandD published an end of support notice for products operating on Windows 7 and Windows 8 platforms.

Western Digital Advisory - Western Digital published an advisory describing an information disclosure vulnerability in their My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices.

Vendor Updates

Siemens Update - Siemens published an update for their SIPROTEC 5 Devices advisory that was originally published on December 13^th, 2022.

NOTE: NCCIC-ICS has not updated their advisory (ICSA-22-349-14) for the new information.

 

For more details about these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-f5b - subscription required.

Review – 1 Advisory and 1 Update Published – 7-19-22

Today, CISA’s NCCIC-ICS published a control system security advisory for products from MiCODUS and updated an advisory for products from Dahua.

MiCODUS Advisory - This advisory describes five vulnerabilities in the MiCODUS MV720 GPS tracker.

Dahua Update - This update provides additional information on an advisory that was originally published on July 12^th, 2022.

 

For more details on the advisory and update, including a link to a researcher report and a down the rabbit hole look at the changes in the update, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-and-1-update-published-824 - subscription required.

Review – 1 Advisory and 1 Update Published – 7-12-22

Today, CISA’s NCCIC-ICS published a control system security advisory for products from Dahua and updated an advisory for products from Schneider Electric.

Dahua Advisory - This advisory describes five vulnerabilities in the Dahua DHI-ASI7213X-T1 facial recognition access controller.

Schneider Update - This update provides additional information on an advisory that was originally published on February 24^th, 2022.

NOTE: Schneider has not made a change to either of their advisories (here and here) that formed the basis for the original NCCIC-ICS advisory.

 

For more information on the Schneider update oddity, the Dahua Advisory, and a Down the Rabbit Hole look at the ‘Secure and Trusted Communications Networks Act of 2019, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-and-1-update-published-14a - subscription required.