Review – 6 Advisories Published – 11-20-25

Today CISA’s NCCIC-ICS published six control system security advisories for products from Emerson, Festo (2), Opto 22, ICAM365 and Automated Logic.

Advisories

Emerson Advisory - This advisory discusses a stack-based buffer overflow vulnerability in the Emerson Appleton UPSMON-PRO.

Festo Advisory #1 - This advisory discusses an improper input validation vulnerability in the Festo Didactic products.

Festo Advisory #2 - This advisory describes a hidden functionality vulnerability in the Festo MSE6-C2M-5000 product line.

NOTE: I briefly discussed this vulnerability on September 9^th, 2023. CERT-VDE updated the Festo advisory (administrative and format changes) on October 1^st, 2025.

Opto 22 Advisory - This advisory describes an OS command injection vulnerability in the Opto 22 GRV Programmable Logic Controllers.

ICAM365 Advisory - This advisory describes two missing authentication for critical function vulnerabilities in the ICAM365 ROBOT PT Camera P201 and Night Vision Camera QC021.

Automated Logic Advisory - This advisory describes two vulnerabilities in multiple Automated Logic (and Carrier) products.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-published-11-20-25 - subscription required.

Review – Public ICS Disclosures – Week of 6-22-24 – Part 2

For Part 2 we have two more vendor disclosures from WatchGuard (2). There are also 23 vendor updates from Hitachi Energy, HP (2), HPE (19), and Moxa. Finally, we have four researcher reports describing vulnerabilities in products from Emerson, Plug&Track, Siemens, and TP-Link.

Advisories

WatchGuard Advisory #1 - WatchGuard published an advisory that describes a privilege escalation vulnerability in their Mobile VPN product.

WatchGuard Advisory #2 - WatchGuard published an advisory that describes a buffer overflow vulnerability in their Fireware OS product.

Updates

Hitachi Energy Update - Hitachi Energy published an update for their IEDConnectivity Packages advisory that was originally published on November 15^th, 2022.

HP Update #1 - HP published an update for their AMD SPI Lock Bypass advisory that was originally published on June 11^th, 2024 and most recently updated on June 18^th, 2024.

HP Update #2 - HP published an update for their Plantronics Hub advisory that was originally published on December 20^th, 2023 and most recently updated on May 10^th, 2024.

HPE Updates - HPE continued updating older Aruba advisories to their HPE format, updating 19 advisories this week.

Moxa Advisory - Moxa published an update for their AWK-3131A Series that was originally published on February 24^th, 2020 and most recently updated on June 3^rd, 2020.

Researcher Report

Emerson Report - Claroty published a report describing four vulnerabilities in the Emerson Rosemount 370XA gas chromatograph.

Plug&Track Report - Nozomi Networks published a report that describes seven vulnerabilities in products from Plug&Track.

Siemens Report - SEC Consult published a report describing three vulnerabilities in the Siemens CP-8XXX Power Automation Products.

TP-Link Report - Talos Intelligence published a report that describes an active debug code in the TP-Link ER7206 Omada Gigabit VPN Router.

 

For more information about these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-746 - subscription required.

Review – 4 Advisories Published – 6-6-24

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Johnson Control, Mitsubishi Electric, and Emerson (2).

Advisories

Johnson Controls Advisory - This advisory describes a missing authentication for critical function vulnerability in the Johnson Control Software House iStar Pro Door Controller, ICU.

Mitsubishi Advisory - This advisory discusses an allocation of resources without limit or throttling vulnerability in the Mitsubishi CC-Link IE TSN Industrial Managed Switch.

Emerson Advisory #1 - This advisory describes two vulnerabilities in the Emerson Ovation distributed control system.

Emerson Advisory #2 - This advisory describes four vulnerabilities in the Emerson PACSystem, Fanuc products.

 

For more information about these advisories, including a brief reprise of earlier discussions about the OT:ICEFALL report that included today’s Emerson vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-6-6-24 - subscription required.

Review – 7 Advisories and 1 Update Published – 1-30-24

Today, CISA’s NCCIC-ICS published seven control system security advisories for products from Rockwell Automation (3), Hitron, Mitsubishi Electric (2) and Emerson. They also updated an advisory for products from Mitsubishi.

Advisories

Rockwell Advisory #1 - This advisory discusses 15 vulnerabilities in multiple Rockwell Operator Panels.

Rockwell Advisory #2 - This advisory describes an improper verification of cryptographic signatures in the Rockwell FactoryTalk Service Platform.

Rockwell Advisory #3 - This advisory describes an improper restriction of operations within the bounds of a memory buffer in the Rockwell ControlLogix and GuardLogix products.

Hitron Advisory - This advisory describes six improper input validation vulnerabilities  in the Hitron HGR and LGUVR series DVRs.

Mitsubishi Advisory #1 - This advisory describes an authentication bypass by capture-replay vulnerability in the Mitsubishi MELSEC WS Series Ethernet Interface Modules.

Mitsubishi Advisory #2 - This advisory describes two vulnerabilities in the Mitsubishi FA Engineering Software Products.

Emerson Advisory - This advisory describes four vulnerabilities in the Emerson Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs.

Updates

Mitsubishi Update - This update provides additional information on an advisory that was originally published on July 27^th, 2023 and most recently updated on December 5^th, 2023.

 

For more information on these advisories, including links to 3^rd party vulnerabilities and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-1-update-published-c5e - subscription required. 

Review – 4 Advisories Published – 7-25-23

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Johnson Controls, Emerson, Rockwell Automation, and AXIS.

Advisories

Johnson Controls Advisory - The advisory describes an improper restrictions of excessive authentication attempts vulnerability in the Johnson Controls IQ Wifi 6 mesh router.

Emerson Advisory - The advisory describes an authentication bypass by primary weakness vulnerability in the Emerson ROC800-Series RTU and DL8000 Preset Controllers.

Rockwell Advisory - The advisory that describes a relative path traversal vulnerability in the Rockwell ThinManager ThinServer.

AXIS Advisory - The advisory describes a heap-based buffer overflow vulnerability in the AXIS A1001 network door controller.

 

For more details about these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-7-25-23 - subscription required.

Review – 7 Advisories and 1 Update Published – 8-16-22

Today, CISA’s NCCIC-ICS published seven control system security advisories for products from Sequi, Emerson, B&R, Delta Industrial, Softing, LS Industrial Systems, and Yokogawa. They also updated an advisory for products from Siemens.

Sequi Advisory - This advisory describes two vulnerabilities in the Sequi PortBloque S serial Modbus firewall.

Emerson Advisory - This advisory describes six vulnerabilities in the Emerson Proficy Machine Edition.

B&R Advisory - This advisory describes an improper input validation vulnerability in the B&R Automation Studio PLC programming software.

NOTE: While this vulnerability was discussed in the Evil PLC Attack paper, it was originally reported by B&R on January 20^th, 2022 which I reported earlier. B&R updated their advisory this week, adding a reference to the Evil PLC Attack paper.

Delta Advisory - This advisory describes an improper restriction of XML external entity reference vulnerability in the Delta DRAS controller software suite.

Softing Advisory - This advisory describes nine vulnerabilities in the Softing Secure Integration Server.

LS Industrial Advisory - This advisory describes an inadequate encryption strength vulnerability in the LS Industrial LS ELEC PLC and XG5000.

Yokogawa Advisory - This advisory describes a resource management errors vulnerability in the Yokogawa CENTUM VP/CS 3000 Controller FCS products.

NOTE: I briefly reported this vulnerability on July 30^th, 2022.

Siemens Update - This update provides additional information on an advisory that originally published on May 12^th, 2022 and most recently updated on July 12^th, 2022.

NOTE: I briefly reported this update on Sunday.

 

For more details about these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-1-update-published-589 - subscription required.

Review – 7 Advisories Published – 8-11-22

Today, CISA’s NCCIC-ICS published seven control system security advisories for products from Schneider Electric, Emerson and Siemens (5). NCCIC-ICS also published 14 updates today, I will address them in a separate blog post.

Schneider Advisory - This advisory describes thirteen vulnerabilities in the Schneider EcoStruxure, EcoStruxure Process Expert, and SCADAPack RemoteConnect for x70.

Emerson Advisory - This advisory discusses an OT:ICEFALL vulnerability in the Emerson ROC800 remote automation controller.

SCALANCE Advisory - This advisory describes three vulnerabilities in the Siemens SCALANCE products.

SICAM Advisory #1 - This advisory describes a hard-coded credentials vulnerability in the Siemens SICAM TOOLBOX II control and monitoring system.

SICAM Advisory #2 - This advisory describes an improper access control vulnerability in the Siemens SICAM A8000 CP-8000, CP-8021, and CP-8022 remote terminal units.

Teamcenter Advisory - This advisory describes two vulnerabilities in the Siemens Teamcenter product lifecycle management software.

Simcenter Advisory - This advisory describes an exposure of sensitive information to unauthorized actor vulnerability in the Siemens Simcenter STAR-CCM+.

 

For more details about the advisories, including links to researcher reports and a discussion about duplicate advisory, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-published-8-11-2 - subscription required.

Review – 3 Advisories Published – 8-9-22

Today, CISA’s NCCIC-ICS published three control system security advisories for products from Emerson (2) and Mitsubishi.

Emerson Advisory #1 - This advisory discusses two OT:ICEFALL vulnerabilities in the Emerson OpenBSI network communications services.

Emerson Advisory #2 - This advisory discusses one OT:ICEFALL vulnerability in the Emerson ControlWave programmable controller.

Mitsubishi Advisory - This advisory discusses two vulnerabilities in the Mitsubishi GT SoftGOT2000.

OT:ICEFALL Update - With today’s advisories there are still 14 vulnerabilities included in the OT:ICEFALL report that have not yet been reported by NCCIC-ICS.

 

For more details on these advisories, including links to 3^rd Party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-published-8-9-22 - subscription required.

Review – 4 Advisories and 2 Updates Published – 6-30-22

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Distributed Data Systems, Emerson, Yokogawa, Exemys. They also updated advisories from CODESYS and Mitsubishi Electric.

Distributed Data Systems Advisory - This advisory describes two vulnerabilities in the Distributed Data Systems WebHMI.

Emerson Advisory - This advisory discusses the OT:ICEFALL vulnerabilities in the Emerson DeltaV Distributed Control System.

NOTE: There are still 15 Emerson OT:ICEFALL vulnerabilities that have not been covered by NCCIC-ICS in Emerson products including: Ovation, OpenBSI, ControlWave, and FANUC.

Yokogawa Advisory - This advisory describes a use of insufficiently random values vulnerability in the Yokogawa Wide Area Communication (WAC) Router.

Exemys Advisory - This advisory describes an improper authentication vulnerability in the Exemys RME1 analog acquisition module.

CODESYS Update - This update provides additional information on an advisory that was originally published on September 15^th, 2015.

Mitsubishi Update - This update provides additional information on an advisory that was originally published on December 16^th, 2021.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-and-2-updates-published - subscription required.

Review – Public ICS Disclosures – Week of 4-30-22 – Part 1

Another busy week requiring a two part post. In Part 1 this week we have 19 vendor disclosures from Aruba Networks (3), Aveva, Axis, Belden (3), Bosch, Broadcom (8), Emerson, and TRUMPF.

Aruba Advisory #1 - Aruba published an advisory discussing an infinite loop vulnerability in multiple products. This is a third-party (OpenSSL) vulnerability.

Aruba Advisory #2 - Aruba published an advisory describing 21 vulnerabilities in their ClearPass Policy Manager.

Aruba Advisory #3 - Aruba published an advisory discussing the TLStorm 2.0 vulnerabilities.

Aveva Advisory - Aveva published an advisory describing an exposure of resource to wrong sphere vulnerability in their  InTouch Access Anywhere and Plant SCADA Access Anywhere products.

Axis Advisory - Axis published an advisory discussing two vulnerabilities (with one known exploit available) in their AXIS P7701 Video Decoder.

Belden Advisory #1 - Belden published an advisory discussing eight vulnerabilities (two with known exploits) in their Provize Basic Frontend.

Belden Advisory #2 - Belden published an advisory discussing two vulnerabilities (one with known exploit) in their Provize Basic Backend.

Belden Advisory #3 - Belden published an advisory discussing an uncontrolled resource consumption vulnerability (with a known exploit) in their Provize Basic product.

Bosch Advisory - Bosch published an advisory discussing five vulnerabilities in their PLC applications of the control systems ctrlX CORE, IndraLogic, IndraMotion MTX, IndraMotion MLC and IndraMotion MLD systems.

Broadcom Advisory #1 - Broadcom published an advisory discussing a link following vulnerability in their Brocade SANnav product.

Broadcom Advisory #2 - Broadcom published an advisory discussing an improper input validation vulnerability (with a known exploit) in their Brocade SANnav product.

Broadcom Advisory #3 - Broadcom published an advisory discussing a deserialization of untrusted data vulnerability in their Brocade SANnav product.

Broadcom Advisory #4 - Broadcom published an advisory describing an information exposure vulnerability in their Brocade SANnav product.

Broadcom Advisory #5 - Broadcom published an advisory describing a plain-text storage of sensitive information vulnerability in their Brocade SANnav product.

Broadcom Advisory #6 - Broadcom published an advisory describing a SQL injection vulnerability in their Brocade SANnav product.

Broadcom Advisory #7 - Broadcom published an advisory describing an inadequate password encryption vulnerability in their Brocade SANnav product.

Broadcom Advisory #8 - Broadcom published an advisory describing a role-based access control vulnerability in their Brocade SANnav product.

Emerson Advisory - Emerson published an advisory discussing two vulnerabilities in their AVENTICS AF2 Series flow sensors.

TRUMPH Advisory - CERT-VDE published an advisory describing a missing authentication for critical function vulnerability in the TRUMPF TruTops products.

 

For more details on these advisories, including links to third-party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-c2b - subscription required.

 

Review - Public ICS Disclosures – Week of 1-29-22 – Part 1

 This has been a very busy week for control system vulnerabilities and it is going to require a two-part post to address all of the information. This week we have 14 vendor disclosures from ABB (3), Aruba (3), Sante, Sealevel, WAGO, Emerson, FANUC, Honeywell (2), Philips, and Rockwell.

ABB Advisory #1 - ABB published an advisory describing three vulnerabilities in their SPIET800 INFI-Net to Ethernet Transfer and PNI800 S+ Ethernet communication interface modules.

ABB Advisory # 2 - ABB published an advisory describing an improper input validation vulnerability in their System 800xA, Symphony® Plus IEC 61850 communication stack.

ABB Advisory #3 - ABB published an advisory describing a remote code execution vulnerability in their OPC Server for AC 800M products.

Aruba Advisory #1 - Aruba published an advisory discussing 15 vulnerabilities in their ArubaOS-CX 8000 Series Switches.

Aruba Advisory #2 - Aruba published an advisory discussing 15 vulnerabilities in their 9000 Series Gateways.

Aruba Advisory #3 - Aruba published an advisory discussing the PwnKit vulnerability in multiple product lines.

Sante Advisory - INCIBE-CERT published an advisory describing seven vulnerabilities in the Sante DICOM Viewer Pro.

Sealevel Advisory - INCIBE-CERT published an advisory describing twelve vulnerabilities in the Sealevel SeaConnect 370W Wi-Fi edge device.

WAGO Advisory - CERT-VDE published an advisory discussing a link following vulnerability in the WAGO e!COCKPIT and WAGO-I/O-Pro.

Emerson Advisory - Emerson published an advisory describing a credential disclosure vulnerability in multiple products. The vulnerability was reported by Dragos.

FANUC Advisory - FANUC published a notice reporting that none of their products are affected by the Log4Shell vulnerability.

Honeywell Advisory #1 - Honeywell published an advisory describing a command injection vulnerability in their IP PTZ Camera HDZP252DI.

Honeywell Advisory #2 - Honeywell published an advisory describing a video replay vulnerability in their IP Camera HBW2PER1.

Philips Advisory - Philips published an advisory discussing the PwnKit vulnerability.

Rockwell Advisory - Rockwell published a notice discussing a problem with the latest Microsoft® DCOM Hardening patch.

 

For more details about these advisories, including links to researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-cfc - subscription required. 

Review - 5 Advisories and 1 Update Published – 12-21-21

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Emerson, WECON, Horner Automation, and mySCADA. They published one medical device security advisory for products from Fresenius Kabi. They also updated a control system security advisory from Schneider.

Emerson Advisory - This advisory describes two vulnerabilities in the Emerson DeltaV distributed control system.

WECON Advisory - This advisory describes two vulnerabilities in the WECON LeviStudioU HMI programming software.

Horner Advisory - This advisory describes an improper input validation vulnerability in the Horner Cscape EnvisionRV remote viewing software.

mySCADA Advisory - This advisory describes eight vulnerabilities in the mySCADA myPRO HMI/SCADA.

Fresenius Advisory -  This medical device advisory describes thirteen vulnerabilities in the Fresenius Kabi Agilia Connect Infusion System.

Schneider Update - This update provides additional information on an advisory that was originally published on December 14^th, 2021.

For more details about these advisories, including an exploit link, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-1-update-published - subscription required.

Review – 4 Advisories and 1 Update Published – 10-5-21

Today CISA’s NCCIC-ICS published four control system security advisories for products from Honeywell, Moxa, Emerson and Mitsubishi. They also updated a medical device advisory for products from Medtronic.

Honeywell Advisory - This advisory describes three vulnerabilities in the Honeywell Experion PKS process control system.

Moxa Advisory - This advisory describes five vulnerabilities in the Moxa MXview network management software.

Emerson Advisory - This advisory describes six vulnerabilities in the Emerson WirelessHART Gateway network communication devices.

Mitsubishi Advisory - This advisory describes four vulnerabilities in the Mitsubishi GOT and Tension Controller.

Medtronic Update - This update provides additional information on an advisory that was originally published on August 8^th, 2018.

For more details about the listed advisories and updates, including CVE numbers, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-and-1-update-published - subscription required.

1 Advisory and 5 Updates Published – 5-18-21

Today CISA’s NCCIC-ICS published one control system security advisory for products from Emerson. They also updated five advisories for products from Mitsubishi. 

Emerson Advisory

This advisory describes six vulnerabilities in the Emerson Rosemount X-STREAM Gas Analyzer. The vulnerabilities are self-reported. Emerson has a firmware update that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker can remotely exploit these vulnerabilities to allow an attacker to obtain sensitive information, modify configuration, or affect the availability of the device.

Multiple Products Update

This update provides additional information on an advisory that was originally published on September 1^st, 2020 and most recently updated January 26^th, 2021. The new information includes updating affected versions and providing mitigation measures for:

• RJ71EN71,

• QJ71E71-100,

• LJ71E71-100,

• QJ71MT91,

• NZ2GACP620-60,

• NZ2GACP620-300, and

• GT25-J71GN13-T2

MELSEC iQ-R Series Update #1

This update provides additional information on an advisory that was originally reported on October 8^th, 2020 and most recently updated on February 18^th, 2021. The new information includes:

• Adding R08/16/32/120PSFCPU to the list of affected products, and

• Updating affected version numbers and adding mitigation measures for R16/32/64MTCPU.

MELSEC iQ-R, Q and L Series Update

This update provides additional information on an advisory that was originally published on October 29^th, 2020. The new information includes:

• Deleting R 08/16/32/120 PSFCPU from the list of affected products, and

• Updating affected version numbers and adding mitigation measures for R 08/16/32/120 PCPU.

MELSEC iQ-R Series Update #2

This update provides additional information on an advisory that was originally published on November 19^th, 2020. The new information includes updating affected version information and adding mitigation measures for:

• R08/16/32/120 PCPU, and

• R08/16/32/120PSFCPU

MELFA Update

This update provides additional information on an advisory that was originally published on January 21^st, 2021. The new information includes:

• Modifying the description of “Countermeasures”, and

  • Adding the IP filter function to “Mitigations”. 

Public ICS Disclosures – Week of 1-23-21

This week we have nine vendor disclosures from Bosch, ZIV Automation (2), Emerson, GE Healthcare, Johnson Controls, Rockwell (2), and Siemens.

Bosch Advisory

Bosch published an advisory describing a stack-based buffer overflow vulnerability in their Rexroth ID 200/C-ETH using EtherNet/IP Protocol. This is a third-party (Real Time Automation) vulnerability. Bosch provides generic mitigation measures.

ZIV Automation Advisories

Incibe-CERT published an advisory describing an uncontrolled resource consumption vulnerability in the ZIV 4CCT Smart Metering Data Concentrator. The vulnerability was reported by Aarón Flecha Menéndez of S21Sec. ZIV has a patch available that mitigates the vulnerability. There is no indication that Menendez has been provided an opportunity to verify the efficacy of the fix.

 

Incibe-CERT published an advisory describing an improper authentication vulnerability in the ZIV 4CCT Smart Metering Data Concentrator. The vulnerability was reported by Aarón Flecha Menéndez of S21Sec. ZIV has a patch available that mitigates the vulnerability. There is no indication that Menendez has been provided an opportunity to verify the efficacy of the fix.

Emerson Advisory

Emerson published an advisory describing the fdtCONTAINER vulnerability in their Rosemont Transmitter Interface Software. Emerson no longer supports that software.

NOTE: This Emerson impact was previously reported by NCCIC-ICS.

GE Healthcare Advisory

GE Healthcare has published an advisory discussing undisclosed vulnerabilities in the VC150 Vital Signs Monitor that they distribute. The Innokas Medical web site simply notes in their software update note for the VC150 that it contains “Cybersecurity enhancements and bug fixes”. GE Healthcare has made the updated software available.

Johnson Controls

Johnson Controls has published an advisory discussing four vulnerabilities in their Sur-Gard System 5 receivers. They are third-party (Treck) vulnerabilities. Johnson Controls has a new version that mitigates the vulnerabilities.

NOTE: This advisory does not specifically name the four vulnerabilities identified by Treck and NCCIC-ICS, it just provides the CVE numbers; CVE-2020-25066,  CVE-2020-27336, CVE-2020-27337, and  CVE-2020-27338.

Rockwell Advisories

Rockwell published an advisory describing the fdtCONTAINER vulnerability in their FactoryTalk AssetCentre. Rockwell has a new version that mitigates the vulnerability.

 

Rockwell published an advisory describing a buffer overflow vulnerability in their MicroLogix 1400 Controller. The vulnerability was reported by Parul Sindhwad and Dr. Faruk Kazi from COE-CNDS. Rockwell provides generic mitigation measures

Siemens Advisory

Siemens published an advisory describing a missing authentication for critical function vulnerability in their SIMATIC HMI Panels. The vulnerability was reported by the Zero Day Initiative. Siemens has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

NOTE: The advisory acknowledges the coordination efforts of CISA, so it is likely that NCCIC-ICS will publish an advisory on this vulnerability next week.

5 Advisories Published – 1-21-21

Today CISA’s NCCIC-ICS published five control system security advisories for products from WAGO, Mitsubishi Electric, Honeywell, and Delta Electronics (2).

WAGO Advisory

This advisory describes a deserialization of untrusted data vulnerability in the M&M Software fdtCONTAINER (M&M is subsidiary of WAGO). The vulnerability was reported by Emerson. M&M has a new version that mitigates the vulnerability (but would not be compatible with existing projects). There is no indication that Emerson has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low skilled attacker could exploit the vulnerability via a social engineering attack to allow malicious code to be executed without notice.

NCCIC-ICS reports that this vulnerability affects products from Emerson and PEPPERL+FUCHS.

NOTE: I briefly discussed this vulnerability last Saturday, but I was not aware that M&M was a subsidiary of WAGO.

Mitsubishi Advisory

This advisory describes an uncontrolled resource consumption vulnerability in the Mitsubishi MELFA product line. The vulnerability was reported by Qi An Xin Group, Inc. Mitsubishi has provided generic mitigation measures for the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to cause a denial-of-service condition.

NOTE: NCCIC-ICS provided an incorrect link for the Mitsubishi advisory (listed as ‘Mitsubishi Electric website’ in this advisory). The link should have been https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-019_en.pdf.

Honeywell Advisory

This advisory describes four vulnerabilities in the Matrikon (a subsidiary of Honeywell) OPC UA Tunneller. The vulnerability was reported by Uri Katz of Claroty. Matrikon has a new version that mitigates the vulnerability. There is no indication that Katz has been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Heap-based buffer overflow - CVE-2020-27297,

• Out-of-bounds read - CVE-2020-27299,

• Improper check for unusual or exceptional conditions - CVE-2020-27274, and

• Uncontrolled resource3 consumption - CVE-2020-27295

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to disclose sensitive information, remotely execute arbitrary code, or crash the device.

TPEditor Advisory

This advisory describes two vulnerabilities in the Delta TPEditor. The vulnerabilities were reported by kimiya via the Zero Day Initiative. Delta has a new version that mitigates the vulnerabilities. There is no indication that kimiya has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Untrusted pointer dereference - CVE-2020-27288, and

• Out-of-bounds write - CVE-2020-27284

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to allow an attacker to execute code under the privileges of the application.

ISPSoft Advisory

This advisory describes a use after free vulnerability in the Delta ISPSoft PLC program development tool. The vulnerability was reported by Francis Provencher via ZDI. Delta has a new version that mitigates the vulnerability. There is no indication that Provencher has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to allow an attacker to execute code under the privileges of the application.

3 Advisories Published – 12-17-20

Today the CISA NCCIC-ICS published three control system security advisories for products from PTC (2) and Emerson.

LinkMaster Advisory

This advisory describes an incorrect default permissions vulnerability in the PTC Kepware LinkMaster application. The vulnerability was reported by Yuri Kramarz of Cisco Talos. PTC has a new version that mitigates the vulnerability. There is no indication that Kramarz has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit this vulnerability to allow a local attacker to globally overwrite the service configuration to execute arbitrary code with NT SYSTEM privileges.

NOTE: The Talos report include proof-of-concept code.

KEPServerEX Advisory

This advisory describes three vulnerabilities in the PTC Kepware KEPServerEX connectivity platform. The vulnerability was reported by Uri Katz of Claroty. PTC has updates that mitigate the vulnerability. There is no indication that Katz has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2020-27265,

• Heap-based buffer overflow - CVE-2020-27263, and

• Use after free - CVE-2020-27267

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to lead to a server crashing, a denial-of-service condition, data leakage, or remote code execution.

NOTE 1: NCCIC-ICS reports that these vulnerabilities could serve as a third-party vulnerability in the following products:

• Rockwell Automation KEPServer Enterprise,

• GE Digital Industrial Gateway Server, and

• Software Toolbox TOP Server

NOTE 2: NCCIC-ICS only provided links to the GE advisory.

Emerson Advisory

This advisory describes an improper authentication vulnerability in the Emerson Rosemount X-STREAM gas analysis software. The vulnerability was reported by Maxim Rupp. Emerson has firmware updates that mitigate the vulnerability. There is no indication that Maxim has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker through a specially crafted URL to download files and obtain sensitive information.

3 Advisories Published – 8-25-20

Today the CISA NCCIC-ICS published three control system security advisories for products from WECON, Emerson, and Advantech.

WECON Advisory

This advisory describes a stack-based buffer overflow vulnerability in the WECON LeviStudioU. The vulnerabilities (see note below) were reported by Natnael Samson via the Zero Day Initiative. WECONis working on mitigation measures.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit this vulnerability to allow an attacker to execute code under the privileges of the application.

NOTE: As I noted last Saturday, Samson reported 22 separate (ZDI-20-1055 thru ZDI-20-1076) stack-based buffer overflow vulnerabilities in this product. NCCIC-ICS lumped the ‘multiple buffer overflow vulnerabilities’ into a single CVE CVE-2019-16243. Samson’s ZDI reports provide the name of each of the affected modules of the program. The ZDI advisories also note that in order to exploit the vulnerabilities an authenticated user must “visit a malicious page or open a malicious file”, presumably this would require a social engineering attack.

Emerson Advisory

This advisory describes an inadequate encryption strength vulnerability in the Emerson OpenEnterprise SCADA Software. The vulnerability was reported by Roman Lozko of Kaspersky. Emerson has a new service pack that mitigates the vulnerability. There is no indication that Lozko has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker access to credentials held by OpenEnterprise used for accessing field devices and external systems.

Advantech Advisory

This advisory describes a path traversal vulnerability in the Advantech iView device management application. The vulnerability was reported by KPC via ZDI. Advantech has a new version that mitigates the vulnerability. There is no indication that KPC has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to read/modify information, execute arbitrary code, limit system availability, and/or crash the application.

2 Advisories Published – 5-19-20

Today the CISA NCCIC-ICS published two control system security advisories for products from Rockwell Automation and Emerson.

Rockwell Advisory

This advisory describes two vulnerabilities in the Rockwell EDS Subsystem. The vulnerabilities were reported by Sharon Brizinov and Amir Preminger (VP Research) of Claroty. Rockwell has a patch available to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper restriction of operations within the bounds of a memory buffer - CVE-2020-12038, and

• SQL injection - CVE-2020-12034

NCCIC-ICS reported that a relatively low-skilled attacker on an adjacent network could exploit the vulnerabilities to  lead to a denial-of-service condition.

Emerson Advisory

This advisory describes three vulnerabilities in the Emerson OpenEnterprise SCADA Software. The vulnerabilities were reported by Roman Lozko of Kaspersky. Emerson has an upgrade that mitigates the vulnerabilities. There is no indication that Lozko has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Missing authentication for critical function - CVE-2020-10640,

• Improper ownership management - CVE-2020-10632, and

• Inadequate encryption strength - CVE-2020-10636

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker access to OpenEnterprise configuration services or access passwords for OpenEnterprise user accounts.

2 Advisories and 1 Update Published – 5-14-20

Today the CISA NCCIC-ICS published two control system security advisories for products from Emerson and Opto 22. They also updated a previously issued advisory for products from 3S.

Emerson Advisory

This advisory describes an improper access control vulnerability in the Emerson WirelessHART Gateways. The vulnerability is self-reported. Emerson has updated firmware that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to disable the internal gateway firewall. Once the gateway's firewall is disabled, a malicious user could issue specific commands to the gateway, which could then be forwarded on to the end user's wireless devices.

Opto 22 Advisory

This advisory describes five vulnerabilities in the  Opto 22 SoftPAC Project virtual PLC. The vulnerabilities were reported by Mashav Sapir of Claroty. Opto 22 has a new version that mitigates the vulnerabilities. There is no indication that Sapir was provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• External control of file name or path - CVE-2020-12042,

• Improper verification of cryptographic signature - CVE-2020-12046,

• Improper access control - CVE-2020-10612,

• Uncontrolled search path element - CVE-2020-10616, and

• Improper authorization - CVE-2020-10620

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow arbitrary file write access with system access, start or stop service, allow remote code execution, and limit system availability.

3S Update

This update provides additional information on an advisory that was originally published on August 1^st, 2019. The new information includes a link to a new version that mitigates the vulnerability. The publication of the new version was originally projected for February 2020.