Review – Public ICS Disclosures – Week of 12-14-24

This week we have 13 vendor disclosures from Dassault Systèmes (4), FortiGuard Labs, GE Vernova (3), Hitachi (3), HPE (2), Meinberg, and Western Digital. We have 11 vendor updates from FortiGuard, Hitachi Energy (8), and Palo Alto Networks. There are also five researcher reports describing vulnerabilities in products from ABB, Delta Electronics (3), and Rockwell Automation. Finally, we have an exploit report for products from FLIR.

Advisories

Dassault Advisory #1 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Collaborative Industry Innovator.

Dassault Advisory #2 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Collaborative Industry Innovator.

Dassault Advisory #3 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Collaborative Industry Innovator.

Dassault Advisory #4 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Collaborative Industry Innovator.

FortiGuard Advisory - FortiGuard published an advisory that describes an OS command injection vulnerability in their FortiManager product.

GE Vernova Advisory #1 - GE published an advisory that discusses two vulnerabilities (both listed in CISA’s Known Exploited Vulnerability catalog) in their Control Server installations utilizing VMware vCenter Server.

GE Vernova Advisory #2 - GE published an advisory that discusses two vulnerabilities (both listed in CISA’s KEV catalog) in their  engineering workstations with Veeam Backup & Replication 9.5, 10, or 11 installed.

GE Vernova Advisory #3 - GE published an advisory that discusses six vulnerabilities (one with publicly available exploit) in their e UCSE, UCSC, and UCSB controllers utilized in the Mark* VIe Platform.

Hitachi Advisory #1 - Hitachi published an advisory that discusses 19 vulnerabilities in their Ops Center Common Services.

Hitachi Advisory #2 - Hitachi published an advisory that describes a missing authentication for critical function vulnerability in their Infrastructure Analytics Advisor and Ops Center Analyzer products.

Hitachi Advisory #3 - Hitachi published an advisory that discusses 56 vulnerabilities in multiple Hitachi products.

HPE Advisory #1 - HPE published an advisory that discusses an improper authentication vulnerability in their SANnav Management Portal.

HPE Advisory #2 - HPE published an advisory that describes an exposure of sensitive information to unauthorized actor vulnerability in their Alletra MP OS.

Meinberg Advisory - Meinberg published an advisory that discusses four vulnerabilities (one with publicly available exploit) in their Lantime product.

Western Digital Advisory - Western Digital published an advisory that discusses three vulnerabilities in their My Cloud Home & Duo products.

Updates

FortiGuard Update - FortiGuard published an update for their regreSSHion advisory that was originally published on July 9^th, 2024, and most recently updated on December 4^th, 2024.

Hitachi Energy Update #1 - Hitachi Energy published an update for their Modbus TCP Packet advisory that was originally published on April 19^th, 2022, and most recently updated on September 24^th, 2024.

Hitachi Energy Update #2 - Hitachi Energy published an update for their RTU500 Series Product advisory that was originally published on March 25^th, 2023, and most recently updated on October 1^st, 2024.

Hitachi Energy Update #3 - Hitachi Energy published an update for their RTU500 series products advisory that was originally published on December 19^th, 2023, and most recently updated on September 24^th, 2024.

Hitachi Energy Update #4 - Hitachi Energy published an update for their RTU500 series Product advisory that was originally published on March 26^th, 2024, and most recently updated on October 1^st, 2024.

Hitachi Energy Update #5 - Hitachi Energy published an update for their RTU500 series Product advisory that was originally published on April 25^th, 2024, and most recently updated on October 1^st, 2024.

Hitachi Energy Update #6 - Hitachi Energy published an update for their RTU500 series Product that was originally published on June 28^th, 2022, and most recently updated on September 24^th, 2024.

Hitachi Energy Update #7 - Hitachi Energy published an update for their RTU500 series Product that was originally published on November 28^th, 2023, and most recently updated on October 1^st, 2024.

Hitachi Energy Update #8 - Hitachi Energy published an update for their RTU500 series Product that was originally published on February 14^th, 2023, and most recently updated on October 1^st, 2024.

Palo Alto Networks Update - Palo Alto Networks published an update for their GlobalProtect App advisory that was originally published on November 25^th, 2024, and most recently updated on December 13^th, 2024.

Researcher Reports

ABB Report - Zero Science published a report that describes an authentication bypass vulnerability (with a publicly available exploit) in the ABB Cylon Aspect building energy management product.

Delta Reports - The Zero Day Initiative published three reports for vulnerabilities in the Delta Electronics DRASimuCAD.

Rockwell Report - ZDI published a report that describes an out-of-bounds write vulnerability in the Rockwell Arena Simulation product.

Exploit

FLIR Exploit - YZS17 published an exploit for a command injection vulnerability in the FLIR AX8 thermal imaging camera.

 

For more information about these notifications, to include links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-3dd   - subscription required.

Review – Public ICS Disclosure – Week of 10-29-22

This week we have twelve vendor disclosures about the recent OpenSSL vulnerabilities from Aruba Networks, Broadcom, Keysight, Milestone, Moxa, Palo Alto Networks, Roche, Rockwell Automation, Software Toolbox, Watchguard, and Wind River.   We also have twelve other vendor disclosures from Belden, Hitachi, Insyde (6), Sick, and Tanzu (3). There are six vendor updates for products from CODESYS. Finally, we have two exploits for products from FLIR, and Veeder-Root.

OpenSSL Vulnerabilities Disclosures

Aruba reports that none of their products are affected by the vulnerabilities.

Broadcom provides a list of unaffected products.

Dell reports that they are reviewing their products to see which may be affected by the vulnerabilities.

Keysight reports that none of their products are affected by the vulnerabilities.

Milestone reports limited impact in their XProtect VMS 2022 R3. An update is pending.

Moxa reports that none of their products are affected by the vulnerabilities.

Palo Alto Networks reports that earlier versions of Cortex XDR Broker VM contain the affected OpenSSL version but are not affected by the vulnerabilities. Other products are not affected.

Roche reports that none of their products are affected by the vulnerabilities.

Rockwell reports that they are reviewing their products to see which may be affected by the vulnerabilities.

Software Toolbox reports that none of their products are affected by the vulnerabilities.

Watchguard provides a list of unaffected products.

Wind River provides a list of affected products. Fixes are pending.

Other Vendor Disclosures

Belden Advisory - Belden published an advisory that describes a command insertion vulnerability in their (Hirschmann) Industrial HiVision product.

Hitachi Advisory - Hitachi published an advisory that discusses 60 vulnerabilities in their Disk Array Systems. These are third-party (Microsoft) vulnerabilities

Insyde Advisory #1 - Insyde published an advisory that discusses an observable discrepancy vulnerability in their InsydeH2O product.

Insyde Advisory #2 - Insyde published an advisory that discusses two vulnerabilities in their InsydeH2O product.

Insyde Advisory #3 - Insyde published an advisory that discusses an out-of-bounds read vulnerability in their InsydeH2O product.

Insyde Advisory #4 - Insyde published an advisory that describes a stack-based buffer overflow vulnerability in their InsydeH2O product.

Insyde Advisory #5 - Insyde published an advisory that describes a stack-based buffer overflow in their InsydeH2O product.

Insyde Advisory #6 - Insyde published an advisory that describes a stack-based buffer overflow in their InsydeH2O product.

Sick Advisory - Sick reports a denial of service vulnerability in their FlexiCompact product.

NOTE: The Sick PSIRT web page continues to have problems with inoperable links.

Tanzu Advisory #1 - Tanzu published an advisory that describes a privilege escalation vulnerability in their pring-security-oauth2-client.

Tanzu Advisory #2 - Tanzu published an advisory that describes an authorization bypass vulnerability in their Spring Security product.

Tanzu Advisory #3 - Tanzu published an advisory that describes a remote code execution vulnerability in their Spring Tools 4 for Eclipse product.

CODESYS Update #1 - CODESYS published an update for their CODESYS communication server advisory that was originally published on May 19^th, and most recently updated on October 6^th, 2022.

CODESYS Update #2 - CODESYS published an update for their V3 web server advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th, 2022.

CODESYS Update #3 - CODESYS published an update for their a CODESYS communication server advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th, 2022.

CODESYS Update #4 - CODESYS published an update for their Control V3 online user management advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th 2022.

CODESYS Update #5 - CODESYS published an update for their V3 products using the CODESYS communication protocol advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th, 2022.

CODESYS Update #6 - CODESYS published an update for their Control V3 configuration file advisory that was originally published on March 24th, 2022, and most recently updated on October 6^th, 2022.

Exploits

FLIR Exploit - Samy Younsi published a Metasploit module for a command injection vulnerability in the FLIR AX8 infrared monitoring camera.

Veeder-Root Exploit - Rose Security published an exploit for a remote configuration disclosure vulnerability in the Veeder-Rood (and probably other vendor) automated tank gauges.

 

For more details about these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-10-c49 - subscription required.