Review – Public ICS Disclosures – Week of 5-25-24

This week we have 16 vendor disclosures from Bosch, Broadcom (3), ELECOM (4), Dassault Systèmes (2), Flexera, Hitachi, HPE, Omron (2), and SEL. There are also nine vendor updates from Hitachi Energy (2), HP (2), HPE (4), and Mitsubishi. We have 16 researcher reports for products from AutomationDirect (8), FortiGuard, libigl (6), and Nokia. Finally, we have an exploit for products from Siemens.

Advisories

Bosch Advisory - Bosch published an advisory that describes an uncontrolled resource consumption vulnerability in their CC13XX-26XX-SDK, BLE5-STACK and CC2340 SDK, BLE5-STACK products.

Broadcom Advisory #1 - Broadcom published an advisory that describes a URL parsing vulnerability in their Spring Framework product.

Broadcom Advisory #2 - Broadcom published an advisory that discusses ten vulnerabilities (three with known exploits) in their Brocade ASCG product.

Broadcom Advisory #3 - Broadcom published an advisory that describes a default community strings vulnerability in their Brocade Directors, Brocade Fabric OS, and Brocade Switches.

ELECOM Advisory #1 - JP-CERT published an advisory that describes an OS command injection vulnerability in the ELECOM WRC-X5400GS-B and WRC-X5400GSA-B wireless LAN routers.

ELECOM Advisory #2 - JP-CERT published an advisory that describes two vulnerabilities in multiple wireless LAN routers and wireless LAN repeaters from ELECOM.

ELECOM Advisory #3 - JP-CERT published an advisory that describes an OS command injection vulnerability in multiple ELECOM wireless LAN routers.

ELECOM Advisory #4 - JP-CERT published an advisory that describes three vulnerabilities in multiple ELECOM wireless LAN routers.

Dassault Advisory #1 - Dassault published an advisory that describes a deserialization of untrusted data vulnerability in their DELMIA Apriso product.

Dassault Advisory #2 - Dassault published an advisory that describes a deserialization of untrusted data vulnerability in their DELMIA Apriso product.

Flexera Advisory - Flexera published an advisory that discusses four vulnerabilities in their FlexNet Publisher.

HPE Advisory - HPE published an advisory that discusses a hardware logic contains race condition vulnerability in their ProLiant DL/ML and MicroServer products.

Omron Advisory #1 - Omron published an advisory that describes an insufficient verification of data authenticity vulnerability in their NJ/NX-series Machine Automation Controllers.

Omron Advisory #2 - Omron published an advisory that discusses three vulnerabilities in their NJ/NX-series Machine Automation Controllers.

SEL Advisory - SEL published a version update for their SEL Compass software.

Updates

Hitachi Energy Update #1 - Hitachi Energy published an update for their AFF660/665 series advisory that was originally published on January 30^th, 2024.

Hitachi Energy Update #2 - Hitachi Energy published an update for their IED ConnPacks advisory that was originally published on November 15^th, 2022. The link provided currently goes to the original version of the advisory.

HP Update #1 - HP published an update for their LaserJet Pro advisory that was originally published on February 20^th, 2024 and most recently updated on April 29^th, 2024.

HP Update #2 - HP published an update for their Laser Jet Managed Printers advisory that was originally published on February 20^th, 2024. The provided link currently goes to a blank page.

HPE Update #1 - HPE published an update for their ProLiant DL/DX/ML/SY/RL/XL/Edgeline Servers that was originally published on April 2^nd, 2024 and most recently updated on May 14^th, 2024.

HPE Update #2 - HPE published an update for their Aruba ArubaOS-CX Switches advisory that was originally published on May 8^th, 2024.

HPE Update #3 - HPE published an update for their NonStop Web ViewPoint Enterprise advisory that was originally published on April 1^st, 2024.

HPE Update #4 - HPE published an update for their Tomcat-based Servlet Engine advisory that was originally published on March 9^th, 2018.

Mitsubishi Update - Mitsubishi published an update for their MELSEC and MELIPC Series advisory that was originally published on June 14^th, 2022 and most recently updated on July 27^th, 2023.

Researcher Reports

AutomationDirect Reports - Talos Intelligence published eight reports describing 13 vulnerabilities in the AutomationDirect P3-550E PLCs.

FortiGuard Report - Horizon3 published a report that describes the identification of CVE-2024-23108 and CVE-2024-23109, command injection vulnerabilities, in the FortiGuard FortiSIEM product.

Libigl Report - Talos Intelligence published six reports describing vulnerabilities in the libigl library.

Nokia Report - IOActive published a report that describes two vulnerabilities in the Nokia FRRO501a  Industrial Fieldrouter.

Exploits

Siemens Exploit - SEC Consult published an exploit for an exposed serial shells vulnerability in the Siemens CP-XXXX Series PLCs.

For more information on these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-cd7 - subscription required.

Review – Public ICS Disclosures – Week of 5-13-23

This week we have 19 vendor disclosures from ABB, Broadcom (6), Flexera, Helmholz, HPE (3), MB Connect, OPC Foundation, SICK, TandD, Western Digital, WAGO, and Zyxel. There are also two updates from BD and HPE. Finally, we have two exploits for products from Ivanti and Siemens.

Advisories

ABB Advisory - ABB published an advisory that describes two vulnerabilities in their Terra AC wallbox.

Broadcom Advisory #1 - Broadcom published an advisory that discusses an out-of-bounds read vulnerability in their Brocade Directors, Brocade Fabric OS, and Brocade Switches.

Broadcom Advisory #2 - Broadcom published an advisory that discusses an SQL injection vulnerability in their Brocade Fabric OS, Brocade SANnav, and Brocade Support Link.

Broadcom Advisory #3 - Broadcom published an advisory that discusses an incorrect permission assignment for critical resource vulnerability in their Brocade SANnav.

Broadcom Advisory #4 - Broadcom published an advisory that discusses an SQL injection vulnerability in their Brocade Fabric OS, Brocade SANnav, and Brocade Support Link.

Broadcom Advisory #5 - Broadcom published an advisory that discusses an SQL injection vulnerability in their Brocade Fabric OS, Brocade SANnav, and Brocade Support Link.

Broadcom Advisory #6 - Broadcom published an advisory that discusses an abuse of service location protocol vulnerability in their Brocade Fabric OS, Brocade SANnav, Brocade Support Link.

Flexera Advisory - Flexera published an advisory that discusses four vulnerabilities in their FlexNet Publisher.

Helmholz Advisory - CERT-VDE published an advisory that discusses two unnamed vulnerabilities in their myREX24 and myREX24.virtual products.

HPE Advisory #1 - HPE published an advisory that discusses four vulnerabilities in their HP-UX products.

HPE Advisory #2 - HPE published an advisory that discusses two vulnerabilities in their Edgeline servers.

HPE Advisory #3 - HPE published an advisory that discusses 11 vulnerabilities in their Cray EX235a Accelerator Blade.

MB Connect Advisory – MB Connect published an advisory that describes an incorrectly implemented object cache vulnerability in their mbCONNECT24 and mymbCONNECT24 products.

OPC Foundation - The OPC Foundation published an advisory that describes an uncontrolled resource consumption vulnerability in their OPC UA Legacy Java Stack.

SICK Advisory - The SICK product security page lists a new advisory for “Vulnerabilities in SICK FTMg”.

TandD Advisory - TandD published an advisory that describes four vulnerabilities in four end-of-life TandD products.

Western Digital Advisory - Western Digital published an advisory that describes four vulnerabilities in their My Cloud OS 5 Firmware.

WAGO Advisory - CERT-VDE published an advisory that describes an OS command injection vulnerability in multiple products from WAGO.

Zyxel Advisory #1 - Zyxel published an advisory that describes four vulnerabilities in their NBG-418N v2 router.

Zyxel Advisory #2 - Zyxel published an advisory that describes a command injection vulnerability in their NBG6604 router.

Updates

BD Update - BD published an update for their BD Totalys™ MultiProcessor that was originally published on October 4^th, 2022.

HPE Update - HPE published an update for their PE Servers using certain Intel Chipset Firmware advisory that was originally published on February 8^th, 2022 an most recently updated on March 3^rd, 2022.

Exploits

Ivanti Exploit - Shelby Pace, Piotr Bazydlo published a Metasploit module for an unrestricted upload of file with dangerous type vulnerability in the Ivanti Avalanche.

Siemens Exploit - RoseSecurity published an exploit for a cross-site request forgery vulnerability in the SIMATIC S7-1200 CPU.

 

For more details on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-978 - subscription required.

Review – Public ICS Disclosures – Week of 4-8-23 – Part 1

And once again it is the Saturday after Cyber Tuesday. For Part 1, we have 34 vendor disclosures from B&R, Flexera, Hikvision, HMS, HP, HPE (3), Insyde (8), Meinberg, Palo Alto Networks (3), Phoenix Contact, Sick, Tanzu (9), and Wireshark (3).

NOTE: It has become obvious that FortiGuard has joined the ranks of organizations that report vulnerabilities en-mass on Cyber Tuesday. As such they will join Schneider and Siemens in being reported in a subsequent Part of the weekend’s Public ICS Disclosure.

Advisories

B&R Advisory - B&R published an advisory that discusses three vulnerabilities in their B&R VC4 Visualization product.

Flexera Advisory - Flexera published an advisory that discusses four vulnerabilities in their FlexNet Publisher product.

Hikvision Advisory - Hikvision published an advisory that describes an improper access control vulnerability in their Hybrid SAN/Cluster Storage products.

HMS Advisory - HMS published an advisory that discusses the INFRA:HALT vulnerabilities.

HP Advisory - HP published an advisory that discusses 31 vulnerabilities in their Device Manager product.

HPE Advisory #1 - HPE published an advisory that describes six disclosure of sensitive information vulnerabilities in their OneView product.

HPE Advisory #2 - HPE published an advisory that describes a disclosure of sensitive information vulnerable in their OneView "Migrate Server Hardware" Option.

HPE Advisory #3 - HPE published an advisory that describes two disclosure of sensitive information vulnerabilities in their OneView Global Dashboard.

Insyde Advisory #1 - Insyde published an advisory that describes a memory corruption vulnerability in their FTBS SMI Handler.

Insyde Advisory #2 - Insyde published an advisory that describes an insufficient input validation vulnerability in their ChipsetSvcSmm.

Insyde Advisory #3 - Insyde published an advisory that describes an Smm RAM corruption vulnerability in their IhisiServicesSmm.

Insyde Advisory #4 - Insyde published an advisory that describes an SMMRAM corruption vulnerability in their IhisiServicesSmm.

Insyde Advisory #5 - Insyde published an advisory that describes a malformed pointer vulnerability in their IhisiServicesSmm.

Insyde Advisory #6 - Insyde published an advisory that discusses a buffer underflow vulnerability in their MdeModulePkg/PiSmmCore.

Insyde Advisory #7 - Insyde published an advisory that discusses an improper restriction of operations within the bounds of a memory buffer vulnerability in their NetworkPkg/IScsiDxe.

Insyde Advisory #8 - Insyde published an advisory that describes a buffer overflow vulnerability in their IhisiSmm.

Meinberg Advisory - Meinberg published an advisory that discusses five NTP vulnerabilities reported by spwpun.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory that describes an exposure of sensitive system information to unauthorized actor vulnerability in their PAN-OS product.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory that describes a TOCTOU race condition vulnerability in their GlobalProtect App.

Palo Alto Networks Advisory #3 - Palo Alto Networks published an advisory that describes an improper handling of exceptional conditions vulnerability in their PAN-OS.

Phoenix Contact Advisory - Phoenix Contact published an advisory that describes a path traversal vulnerability in their ENERGY AXC PU, SMARTRTU AXC and Infobox products.

Sick Advisory - Sick published an advisory that describes a use of obsolete function vulnerability in their  Flexi Soft and Flexi Classic Gateways products.

Tanzu Advisory #1 - Tanzu published an advisory that discusses six Ubuntu vulnerabilities that affect the Tanzu Operations Manager.

Tanzu Advisory #2 - Tanzu published an advisory that discusses an integer overflow or wraparound vulnerability in their Platform Automation Toolkit and Operations Manager products.

Tanzu Advisory #3 - Tanzu published an advisory that discusses an integer overflow or wraparound vulnerability in their Greenplum for Kubernetes product.

Tanzu Advisory #4 - Tanzu published an advisory that discusses eight Ubuntu vulnerabilities in the Tanzu Greenplum for Kubernetes product. Tanzu.

Tanzu Advisory #5 - Tanzu published an advisory that discusses two Ubuntu vulnerabilities in the Tanzu Isolation Segment, Operations Manager and Tanzu Application Service products.

Tanzu Advisory #6 - Tanzu published an advisory that discusses an interpretation conflict vulnerability in the Tanzu Isolation Segment and Tanzu Application Service products.

Tanzu Advisory #7 - Tanzu published an advisory that discusses three Ubuntu vulnerabilities in the Tanzu Isolation Segment and Tanzu Application Service products.

Tanzu Advisory #8 - Tanzu published an advisory that discusses two Ubuntu vulnerabilities in the Tanzu Tanzu Isolation Segment, Operations Manager and Tanzu Application Service products.

Tanzu Advisory #9 - Tanzu published an advisory that discusses a denial of service vulnerability in their Platform Automation Toolkit.

Wireshark Advisory #1 - Wireshark published an advisory that describes a packet injection vulnerability in their RPCoRDMA dissector.

Wireshark Advisory #2 - Wireshark published an advisory that describes a packet injection vulnerability in their LISP dissector.

Wireshark Advisory #3 - Wireshark published an advisory that describes a packet injection vulnerability in their GQUIC dissector. Wireshark has new versions that mitigate the vulnerability.

 

For more details about these disclosures, including links to third-party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-afc - subscription required.

Review – Public ICS Disclosure – Week of 8-13-22

This week we have ten vendor disclosures from Aruba Networks, Aveva, Broadcom, Flexera, GE Grid Solutions, QNAP (2), Softing and WAGO (2). There are five vendor updates from B&R, Mitsubishi Electric, Palo Alto Networks, and Schneider (2). We also have a researcher report for products from Boeing. Finally, we have four exploits for products from Palo Alto Networks, FLIR (2), and Advantech.

Aruba Advisory - Aruba published an advisory that describes a sensitive information disclosure vulnerability in their Virtual Internet Access client for Windows.

Aveva Advisory - Aveva published an advisory that describes six vulnerabilities in their Edge product (formerly Indusoft Web Studio).

NOTE: Aveva reports that the vulnerabilities were coordinated through ‘ICS-CERT’ and ZDI, so I expect that there will be a NCCIC-ICS advisory next week.

Broadcom Advisory - Broadcom published an advisory that discusses an OS command injection vulnerability in their SANnav products.

Flexera Advisory - Revenera published an advisory that discusses two vulnerabilities in their FlexNet Publisher.

GE Grid Advisory - GE published an advisory for their Reason S20 product.

QNAP Advisory #1 - QNAP published an advisory that discusses seven vulnerabilities in their NAS products.

QNAP Advisory #2 - QNAP published an advisory that discusses five vulnerabilities in their NAS products.

Softing Advisory - Softing published an advisory that discusses five vulnerabilities in their OPC UA .NET SDK products.

WAGO Advisory #1 - CERT-VDE published an advisory that discusses six vulnerabilities in multiple WAGO product families.

WAGO Advisory #2 - CERT-VDE published an advisory that discusses four vulnerabilities in multiple WAGO product families.

B&R Update - B&R published an update for their Project Upload advisory that was originally published on January 20^th, 2022.

Mitsubishi Update - Mitsubishi published an update for their OpenSSL advisory that was originally published on August 2^nd, 2022.

Palo Alto Networks Update - Palo Alto Networks published an update for their PAN-OS advisory that was originally published on August 10^th, 2022.

Schneider Update #1 - Schneider published an update for their OPC UA advisory that was originally published on July 12^th, 2022 and most recently updated on August, 9^th, 2022.

Schneider Update #2 - Schneider published an update for their APC Smart-UPS advisory that was originally published on March 8^th, 2022 and most recently updated on July 12^th, 2022.

Boeing Report - Pen Test Partners published a report describing two vulnerabilities in the Boeing Onboard Performance Tool (OPT).

Palo Alto Networks Exploit - UnD3sc0n0c1d0 published an exploit for an OS command injection vulnerability in the Palo Alto PAN-OS.

FLIR Exploit #1 - Samy Younsi published an exploit for a remote command execution vulnerability in the FLIR AX8 thermal imaging camera.

FLIR Exploit #2 - Samy Younsi and Thomas Knudsen published an exploit for three vulnerabilities in the FLIR AX8 thermal imaging camera.

Advantech Exploit - Rgod, Shelby Pace, and Y4er published a Metasploit module for a command injection vulnerability in the Advantech iView NetworkServlet.

 

For more details about these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-8-13 - subscription required.

Review – Public ICS Disclosures – Week of 7-16-22

This week we have ten vendor disclosures from Dell, Eaton, Flexera, Honeywell, HP, HPE (2), Rockwell, and SonicWall. We also have four vendor updates from Aruba Networks (2), Fujitsu, and HP. Finally, we have one researcher report for products from Schneider Electric.

Dell Advisory - Dell published an advisory that discusses 28 vulnerabilities (two with known exploits) in their Wyse Management Suite.

Eaton Advisory - Eaton published an advisory that describes an unrestricted file upload vulnerability in their Foreseer software.

Flexera Advisory - Flexera published an advisory that discusses the log4j remote code execution vulnerability (CVE-2021-44832).

Honeywell Advisory - Honeywell published an end-of-life notice for their equIP® Series IP Cameras, Performance Series IP and HQA Cameras, and Performance Series NVRs, and DVR.

HP Advisory - HP published an advisory that discusses seven vulnerabilities in their UEFI Secure Boot Database.

HPE Advisory #1 - HPE published an advisory that describes a disclosure of sensitive information vulnerability in their OneView product.

HPE Advisory #2 - HPE published an advisory that discusses an endless loop vulnerability in their NonStop products.

Rockwell Advisory - Rockwell published an advisory that discusses the SpringShell vulnerability in their FactoryTalk Analytics DataView product.

SonicWall Advisory - SonicWall published an advisory that describes an SQL injection vulnerability in their GMS AND Analytics products.

Aruba Update #1 - Aruba published an update for their OpenSSL advisory that was originally published on May 4^th, 2022 and most recently updated on June 1^st, 2022.

Aruba Update #2 - Aruba published an update for their Expat XML advisory that was originally published on May 17^th, 2022 and most recently updated on July 7^th, 2022.

Fujitsu Update - Fujitsu published an update for their ETERNUS CS8000 advisory that originally published on June 1^st, 2022.

HP Update - HP published an update for their Jumpstart advisory that originally published on May 10^th, 2022.

Schneider Report - Zero Science Labs published a report describing an OS command injection vulnerability in the Schneider SpaceLogic C-Bus Home Automation System.

 

For more details on these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-7-c9a - subscription required.

Review – Public ICS Disclosures – Week of 7-9-22 – Part 1

For a 2nd Tuesday weekend there is just a moderate number of disclosures, but I will still need to do two parts to keep these post sizes reasonable. So, for Part 1 this week we have 22 vendor disclosures from ABB, Bentley (7), Broadcom, Flexera, Hitachi Energy (2), Lenze, HP, QNAP, Rockwell Automation, Sonic Wall, VMware (3), and Western Digital (2).

NOTE: NVD.NIST.gov is now specifically identifying when a CVE is listed in CISA's Known Exploited Vulnerabilities Catalog

ABB Advisory - ABB published an advisory that describes a path traversal vulnerability in ABB flow computer and remote controller products.

Bentley Advisory #1 - Bentley published an advisory that describes an out-of-bounds read vulnerability in their MicroStation and MicroStation-based applications.

Bentley Advisory #2 - Bentley published an advisory that describes an out-of-bounds read vulnerability in their MicroStation and MicroStation-based applications.

Bentley Advisory #3 - Bentley published an advisory that describes an out-of-bounds read vulnerability in their MicroStation and MicroStation-based applications.

Bentley Advisory #4 - Bentley published an advisory that describes an out-of-bounds read vulnerability in their MicroStation and MicroStation-based applications.

Bentley Advisory #5 - Bentley published an advisory that describes an out-of-bounds read vulnerability in their MicroStation and MicroStation-based applications.

Bentley Advisory #6 - Bentley published an advisory that describes an out-of-bounds read vulnerability in their MicroStation and MicroStation-based applications.

Broadcom Advisory - Broadcom published an advisory that describes a deserialization of untrusted data vulnerability in their com.alibaba:fastjson JSON parser package.

Flexera Advisoyr - Flexera published an advisory that discusses two recent Microsoft vulnerabilities (CVE-2022-30190 and CVE-2022-30136).

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that discusses thirteen vulnerabilities (three with known exploits) in their MSM high-voltage switchgear monitoring system.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that describes two vulnerabilities in their MSM high-voltage switchgear monitoring system.

Lenze Advisory - CERT-VDE published an advisory that describes a missing critical step in authentication vulnerability in the Lenze machine controller.

HP Advisory - HP published an advisory that discusses the RETbleed vulnerabilities in their Wolf Security software.

QNAP Advisory - QNAP published an advisory that discusses the Checkmate ransomware that appears to be targeting QNAP products with SMB services exposed to the internet.

Rockwell Advisory - Rockwell published an advisory that discusses a CHROME type confusion vulnerability in multiple products.

SonicWall Advisory - SonicWall published an advisory that discusses an OS command injection vulnerability in their products.

VMware Advisory #1 - VMware published an advisory that describes a server-side request forgery vulnerability in their vCenter Server.

VMware Advisory #2 - VMware published an advisory that describes two cross-site scripting vulnerabilities in their vRealize Log Insight product.

VMware Advisory #3 - VMware published an advisory that describes four vulnerabilities in their ESXi and Cloud Foundation products.

Western Digital Advisory #1 - Western Digital published an advisory that discuses three NULL pointer dereference vulnerabilities in their EdgeRover application.

Western Digital Advisory #2 - Western Digital published an advisory that discusses 44 vulnerabilities in their My Cloud Home devices.

 

For more details on these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-7-9bc  - [7-16-22 10:23 EDT, added link] subscription required. 

Review - Public ICS Disclosures – Week of 11-13-21 – Part 2

For Part 2 we have six vendor disclosures from Flexera, HPE, Meinberg, QNAP, Tanzu, and VMware. There as an update from CODESYS. We also have six researcher reports about vulnerabilities in products from LibreCad (3) and Open Design Alliance (3).

Flexera Advisory - Flexera published an advisory describing an open redirect vulnerability in their FlexNet Publisher.

HPE Advisory - HPE published an advisory discussing four vulnerabilities in their Fibre Channel Host Bus Adapters.

Meinberg Advisory - Meinberg published an advisory describing six vulnerabilities in their LANTIME-Firmware.

QNAP Advisory - QNAP published an advisory describing a cross-site scripting vulnerability in their NAS running Ragic Cloud DB.

Tanzu Advisory - Tanzu published an advisory describing a code injection vulnerability in their Spring Cloud Netflix Hystrix Dashboard.

VMware Advisory - VMware published an advisory describing a privilege escalation vulnerability in their VMware Center Server.

CODESYS Update - CODESYS published an update for their Gateway V3 advisory that was originally published on March 29^th, 2021  and most recently updated on May 18^th, 2021.

LibreCad Report #1 – Talos published a report describing a use after free vulnerability in the LibreCad libdxfrw. This is a coordinated disclosure.

LibreCad Report #2 - Talos published a report describing an improper restriction of operations within the bounds of a memory buffer in the LibreCad libdxfrw.

LibreCad Report #3 - Talos published a report describing an out-of-bounds write vulnerability in the LibreCad libdxfrw.

ODA Report #1 - ZDI published a report describing a use-after-free vulnerability in the ODA ODAviewer product.

ODA Report #2 - ZDI published a report describing an out-of-bounds read vulnerability in the ODA ODAviewer product.

ODA Report #3 - ZDI published a report describing an out-of-bounds read vulnerability in the ODA ODAviewer product.

For more details about these advisories and reports, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-e7c - subscription required.

Review - Public ICS Disclosures – Week of 11-13-21 – Part 1

Review - Public ICS Disclosures – Week of 11-13-21 – Part 1

This has been a very busy week for vendor disclosures, so I will be doing this as a two-part report again this week. This week we have 17 vendor disclosures from Blackberry, Braun (2), WAGO (3), Dell, Gallagher (6), and ABB (4).

Blackberry Advisory - Blackberry published an advisory describing a remote code execution vulnerability in their QNX Software Development Platform.

Braun Advisory #1 - Braun published an advisory discussing the NUCLEUS:13 vulnerabilities.

Braun Advisory #2 - Braun published an advisory discussing the INFRA:HALT vulnerabilities.

WAGO Advisory #1 - CERT-VDE published an advisory discussing six vulnerabilities in a number of WAGO PLCs.

WAGO Advisory #2 - CERT-VDE published an advisory discussing an improper handling of exceptional conditions vulnerability in a number of WAGO PLC’s.

WAGO Advisory #3 - CERT-VDE published an advisory discussing the NUCLEUS:13 vulnerabilities.

Dell Advisory - Dell published an advisory describing five vulnerabilities in their Wyse Management Suite.

Gallagher Advisory #1 - Gallagher published an advisory describing an unquoted service path vulnerability in their Controller Service.

Gallagher Advisory #2 - Gallagher published an advisory describing an improper privilege validation vulnerability in their Command Centre Server.

Gallagher Advisory #3 - Gallagher published an advisory describing an improper certificate validation vulnerability in their Command Centre Server.

Gallagher Advisory #4 - Gallagher published an advisory describing an improper validation of the cloud-certificate chain in their Mobile Connect for Android.

Gallagher Advisory #5 - Gallagher published an advisory describing an improper validation of the cloud-certificate chain in their Command Centre Mobile Client for Android.

Gallagher Advisory #6 - Gallagher published an advisory describing an incomplete comparison with missing factors vulnerability in their Gallagher Controller.

ABB Advisory #1 - ABB published an advisory discussing two vulnerabilities in their Hitachi Energy RTU500 series.

ABB Advisory #2 - ABB published an advisory discussing the BadAlloc vulnerabilities in their Hitachi Energy RTU500 series.

ABB Advisory #3 - ABB published an advisory discussing three vulnerabilities in their Hitachi Energy RTU500 Series.

ABB Advisory #4 - ABB published an advisory describing a validation error vulnerability in their Hitachi Energy RTU500 Series.

For more information on these advisories, including links to third-party advisories and exploits, see  my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-880 - subscription required.

Review - Public ICS Disclosures – Week of 7-3-21

This week we have thirteen vendor disclosures from ABB, Bosch, B&R Industrial Automation (3), Flexera, GE Healthcare, Hitachi, HMS Networks, Philips, QNAP, Rockwell Automation, and SonicWall. We have four researcher reports of vulnerabilities in products from Advantech (2), Ricon, and VMWare.

ABB Advisory - ABB published an advisory describing a serial number misuse vulnerability in their Busch®-ControlTouch product.

Bosch Advisory - Bosch published an advisory discussing three vulnerabilities in their Rexroth products.

B&R Advisory #1 - B&R published an advisory describing an out-of-bounds write vulnerability in their X20 EthernetIP Adapter.

B&R Advisory #2 - B&R published an advisory describing an out-of-bounds write vulnerability in their  PROFINET IO Devices.

B&R Advisory #3 - B&R published an advisory describing a denial of service vulnerability in their Automation Runtime product.

Dell Advisory - Dell published an advisory describing two vulnerabilities in their Dell Wyse Management Suite.

Flexera Advisory - Flexera published an advisory describing an exposure of sensitive information to an unauthorized actor vulnerability in their FlexNet Publisher.

GE Healthcare Advisory - GE Healthcare published an advisory discussing the PrintNightmare vulnerabilities.

Hitachi Advisory - Hitachi published an advisory discussing 23 vulnerabilities in their Hitachi Disk Array Systems.

HMS Advisory - HMS published an advisory describing an insecure file system permission vulnerability in their eCatcher product.

Philips Advisory - Philips published an advisory discussing the Kaseya VSA supply chain attack.

QNAP Advisory - QNAP published an advisory describing an improper access control vulnerability in their Legacy HBS 3 (Hybrid Backup Sync) product.

Rockwell Advisory - Rockwell published their advisory for the vulnerability reported this week by NCCIC-ICS.

SonicWall Advisory - SonicWall published an advisory describing an out-of-bounds read vulnerability in their SonicWall Switch product.

Advantech Report - ZDI published two reports (here and here) of stack-based buffer overflow vulnerabilities in the Advantech web access product.

Ricon Report - Zero Science Lab published a report describing an OS command injection vulnerability in the Ricon S9922L series LTE router.

VMWare Report - NCC Group published a report on exploiting CVE-2021-3156 VMWare vCenter Server 7.0 product.

For a more detailed discussion of the advisories see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-ac2 - subscription required.

6 Advisories Published – 10-13-20

Today the CISA NCCIC-ICS published six control system security advisories for products from Siemens (2), Fieldcomm Group, Flexera, LCDS, and Moxa.

SIPORT Advisory

This advisory describes a use of client-side authentication vulnerability in the Siemens SIPORT MP access control system. The vulnerability is self-reported. Siemens has a new version that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an authenticated attacker to impersonate other users of the system and perform (potentially administrative) actions on behalf of those users if the single sign-on feature (“Allow logon without password”) is enabled.

Desigo Advisory

This advisory describes three vulnerabilities in the Siemens Desigo Insight product. The vulnerabilities were reported by Davide De Rubeis, Damiano Proietti, Matteo Brutti, Stefano Scipioni, and Massimiliano Brolli from TIM Security Red Team Research. Siemens has a ‘hotfix’ available to mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• SQL injection - CVE-2020-15792,

• Improper restriction of rendered UI layers or frames - CVE-2020-15793, and

• Exposure of sensitive information to an unauthorized actor - CVE-2020-15794

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to retrieve or modify data and gain access to sensitive information.

Fieldcomm Group Advisory

This advisory describes a stack-based buffer overflow vulnerability in the Fieldcom HARP-IP Developer kit. The vulnerability was reported by Reid Wightman from Dragos, Inc. Fieldcomm has a new version for one of the affected products that mitigates the vulnerability. There is no indication that Wightman has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to  crash the device being accessed; a buffer overflow condition may allow remote code execution.

Flexera Advisory

This advisory describes an untrusted search path vulnerability in the Flexera InstallShield product. The vulnerability was reported by an anonymous researcher. Flexera will only provide mitigation measures and work arounds to registered owners.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow execution of a malicious DLL.

NOTE: This vulnerability was reported by Flexera in 2016, so why is NCCIC-ICS reporting this now? Both IBM (Tivoli Storage Manager) and Tenable (Nessus Network Monitor) have issued advisories covering this as a third-party vulnerability in 2016 and 2019 respectively. I suspect that there are other vendors that also use InstallShield that may be unaware of the vulnerability or may not have addressed it.

LCDS Advisory

This advisory describes an out-of-bounds read vulnerability in the LCDS LAquis SCADA. The vulnerability was reported by an anonymous researcher via the Zero Day Initiative. LCDS has a new version that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit this vulnerability to allow an attacker to execute code under the privileges of the application.

Moxa Advisory

This advisory describes six vulnerabilities in the Moxa NPort IAW5000A-I/O Series integrated serial device server. The vulnerabilities were reported by Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar. Moxa has an updated firmware version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Session fixation - CVE-2020-25198,

• Improper privilege management - CVE-2020-25194,

Weak password requirements - CVE-2020-25153,

• Cleartext transmission of sensitive information - CVE-2020-25190,

• Improper restriction of excessive authorization attempts - CVE-2020-25196, and

• Exposure of sensitive information to unauthorized actor - CVE-2020-25192

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to gain access to and hijack a session; allow an attacker with user privileges to perform requests with administrative privileges; allow the use of weak passwords; allow credentials of third-party services to be transmitted in cleartext; allow the use of brute force to bypass authentication on an SSH/Telnet session; or allow access to sensitive information without proper authorization.

NOTE: I briefly described these vulnerabilities back in August. Moxa has updated their advisory to list the CVE numbers assigned by NCCIC-ICS.

Siemens Updates

NCCIC-ICS also published four Siemens updates today. I will cover them in a post tomorrow.

Public ICS Disclosures – Week of 7-11-20

This week we have four Ripple20 vendor disclosures from Siemens, ABB, Rockwell, Carestream and Schneider Electric; two SigRed vendor disclosures from Philips and GE Healthcare; and three other vendor disclosures from HMS and Schneider (2). Four vendor updates from Schneider (2) and Siemens (2) and  two researcher disclosures for products from Siemens and Advantech round out the weeks’ offerings.

Ripple20 Disclosures and Updates

Siemens published a Ripple20 advisory for their SPPA-T3000 Solutions distributed control system. Siemens provides generic mitigation measures for these vulnerabilities.

NOTE: Siemens published a note at the top of their Security Publications page noting that:

“No Siemens product is known to use Treck Inc.'s TCP/IP stack, or otherwise be affected by the reported vulnerabilities.

“Note that Siemens products and systems might interact with products from other manufacturers which are affected by the reported vulnerabilities. In such cases Siemens recommends that owners of operational infrastructures verify if these products are affected and evaluate the potential impact of the Ripple20 vulnerabilities.”

Since the SPPA-T3000 advisory also contains two Intel Server Platform Services vulnerabilities, I suspect that the Ripple20 vulnerabilities come with the Intel server upon which the T-3000 is built.

ABB published a Ripple20 advisory. The advisory contains a list of affected products and generic mitigation measures pending further work to address the vulnerabilities.

Rockwell updated their Ripple20 advisory. The new information includes an updated table of affected products.

Carestream updated their Ripple20 advisory (.PDF download link). The new information includes adding 20 products that were on the ‘still evaluating list’ to the not affected list. The list of affected products has not changed.

Schneider updated their Ripple20 advisory. The new information includes removing the “Smartlink ELEC” from the list of affected products.

SigRed Disclosures

SigRed is the ‘cute’ name given to the Microsoft ‘wormable’ remote code execution DNS vulnerability (CVE-2020-1350).

Phillips published a SigRed advisory noting that: “Philips is currently in the process of evaluating the Microsoft patch and vendor recommended mitigation options.”

GE Healthcare published a SigRed advisory noting that: “GE Healthcare is actively assessing products that utilize impacted Microsoft Operating Systems.”

Neither of these advisories provide much in the way of information beyond noting that a vague ‘some’ of their products may be affected.

Vendor Disclosures

HMS published an advisory describing a remote code execution vulnerability in their eCatcher product. The vulnerability was reported by Claroty. HMS has an update that mitigates the vulnerability. There is no indication that Claroty was provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing an open redirect vulnerability in their Schneider Electric Software Update (SESU). The vulnerability was reported by Amir Preminger of Claroty. Schneider has a new version that mitigates the vulnerability. There is no indication that Preminger has been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing two denial of service vulnerabilities in their Floating License

Manager. These are third-party vulnerabilities in the Flexera FlexNet Publisher (reported here and here). Schneider has a new version that mitigates these vulnerabilities.

NOTE: Flexera is also reporting three other vulnerabilities (CVE-2019-8963, CVE-2020-12080, and CVE-2020-12081) that could potentially affect the Schneider Floating License Manager and a variety of other vendor ‘license manager’ products based upon the Flexera product.

Vendor Updates

Schneider updated their ZombieLoad advisory. The new information includes updated mitigation measures for the HMI products.

Schneider updated their BlueKeep advisory. The new information includes updated mitigation measures for the HMI products.

Siemens updated their Vulnerabilities in Intel CPUs advisory. The new information includes:

• Updated mitigation and affected version information for SIMATIC ITP1000, and

• Removed SIMATIC IPC827E from list of affected devices

Siemens updated heir GNU/Linux advisory. The new information includes adding:

CVE-2020-12114,

• CVE-2020-12659,

• CVE-2020-13630,

• CVE-2020-13631, and

• CVE-2020-13632

Researcher Disclosures

Talos published a report on the Siemens LOGO web server vulnerability that was reported earlier this week. The Talos report includes proof-of-concept code for the vulnerability.

The Zero Day Initiative published 43 reports, all based upon research by rgod, about the Advantech iView vulnerabilities that were reported earlier this week. Most of the reports provided more details on the three CVE’s listed in the NCCIC-ICS advisory. One of the reports, however, described an input validation vulnerability that was not reported by NCCIC-ICS.

Public ICS Disclosures – Week of April 25th, 2020

This week we have two vendor disclosures for products from Moxa and BD. We also have one researcher disclosure for products from Flexera.

Moxa Advisory

Moxa published an advisory describing an unauthenticated information disclosure vulnerability in their NPort 5100A Series Serial Device Servers. The vulnerability was reported by Maayan Fishelov from SCADAfence. Moxa has a new firmware version that mitigates the vulnerability. There is no indication that Fishelov has been provided an opportunity to verify the efficacy of the fix.

BD Advisory

BD published an advisory describing a third-party scripting engine memory corruption vulnerability affecting their product line. The Internet Explorer® vulnerability was reported and fixed by Microsoft in February 2020. BD is currently working to test and validate the Microsoft patch for BD products.

Flexera Advisory

Tenable published a report describing an  improper validation of user-supplied data vulnerability in the Flexera FlexNet Publisher. This was a coordinated disclosure. Flexera has a new version that mitigates the vulnerability. The Tenable report includes proof-of-concept exploit code.

NOTE: This license management tool is used as a third-party component of many products, including some ICS products from vendors like Johnson Controls, Schneider Electric and Rockwell to name a few that have shown up invulnerability reports in the past. It will be interesting to see how fast we see the subsidiary reporting from those affected vendors.

Public ICS Disclosures – Week of 11-30-19

This week we have three vendor disclosures for products from BD, GE and Johnson Controls and an URGENT/11 update from Belden. There are also three exploit code reports for products from Fronius, Salto and YachtControl.

BD Advisory

BD published an advisory describing and anti-virus bypass vulnerability in BD products with workstations running CylancePROTECT®. The third-party vulnerability was originally reported by Skylight. BD recommends updating the CylancePROTECT product.

NOTE: I wonder what other ICS vendors bundle CylancePROTECT as a cybersecurity tool? Since the product does not need to do signature updates it would seem to be a tool designed for control system security.

GE Advisory

GE published an advisory describing two privilege escalation vulnerabilities in the GE Digital HMI/SCADA iFIX product. The vulnerability was reported by Applied Risk. GE provides generic mitigation guidance for the vulnerability.

Johnson Controls Advisory

Johnson Controls published an advisory describing vulnerabilities in a third-party component of their Software House C•CURE 9000 application. The vulnerabilities in the Flexera FlexNet Publisher licensing manage have been previously reported. Johnson Controls has an update that mitigates the vulnerability.

Belden Update

Belden published an update of their URGENT/11 advisory that was originally published July 29^th, 2019 and most recently updated on October 30^th, 2019. The new information includes update information for Hirschmann HiOS RSPE TSN.

Fronius Expliot

SEC Consult published a report containing exploit code for four vulnerabilities in the solar inverter series of Fronius. This is reportedly a coordinated disclosure. Fronius has a firmware patch that mitigates the vulnerabilities. There is no indication that SEC Consult has been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Unencrypted communication;

• Authenticated path traversal - CVE-2019-19229;

• Backdoor account - CVE-2019-19228; and

• Outdated and vulnerable software components

NOTE: This is the first time that I have seen an easter-egg included in a vulnerability report.

Salto Exploit

SEC Consult published a report containing exploit code for six vulnerabilities in the Salto ProAccess Space management software for an access control system. This is reportedly a coordinated disclosure. Salto has a patch that mitigates the vulnerabilities. There is no indication that SEC Consult has been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Path traversal - CVE-2019-19458;

• Arbitrary file write - CVE-2019-19459;

• Stored cross-site scripting - CVE-2019-19457;

• Webserver running as Windows Service per default - CVE-2019-19460;

• Authorization issues; and

• Cleartext transmission of sensitive data

Yachtcontrol Exploit

Hodorsec published exploit code for a remote code execution vulnerability in the Yachtcontrol web application. The report includes a CVE number so this may be a coordinated disclosure.

1 Advisory Published – 11-19-19

Today the CISA NCCIC-ICS published a control system security advisory for products from Flexera.

Flexera Advisory

This advisory describes four vulnerabilities in the Flexera FlexNet Publisher software license manager. The vulnerabilities were reported by Sergey Temnikov of Kaspersky. Flexera has a new version that mitigates the vulnerability. There is no indication that Temnikov has been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Improper input validation (3) - CVE-2018-20031, CVE-2018-20032 and CVE-2018-20034; and

• Memory corruption - CVE-2018-20033

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to deny the acquisition of a valid license for legal use of the product. The memory corruption vulnerability could allow remote code execution.

Previously Reported

These same four CVE#s were reported by Schneider in their Floating License Manager back in May 14^th, 2019 followed by an NCCIC-ICS advisory on July 11^th, 2019. NIST reported the CVE#s as being in the FlexNet Publisher on March 25^th, 2019 with the following link to the Flexera advisory (registration required).

The FlexNet Publisher is fairly obviously being used by Schneider. We have seen this sort of vulnerability pairing between the two products on multiple occasions. I suspect that other vendors are also using FlexNet Publisher in their products. Should we be seeing more vulnerabilities on these 4 CVE’s? Apparently only if other researchers like Temnikov check other license managers to see if they can see the same problem.

7 Advisories Published – 07-11-19

Yesterday the DHS NCCIC-ICS published six industrial control system advisories for products from Schneider Electric (2), AVEVA, Siemens (3) and Delta Industrial. They also published a medical device security advisory for products from Philips.

Interactive Graphical SCADA Advisory

This advisory describes an out-of-bounds write vulnerability in the Schneider Interactive Graphical SCADA System (IGSS). The vulnerability was reported by mdm and rgod of 9SG Security Team via the Zero Day Initiative. Schneider has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to  allow an attacker to achieve arbitrary code execution or crash the software.

Floating License Manager Advisory

This advisory describes four vulnerabilities in the Schneider Floating License Manager. The vulnerabilities are self-reported. According to the Schneider advisory, the vulnerabilities are in a third-party component (Flexera FlexNet Publisher) of their product. Schneider has a patch available that mitigates the vulnerability.

The four reported vulnerabilities are:

• Improper input validation (3) - CVE-2018-20031, CVE-2018-20032, and CVE-2018-20034; and

• Memory corruption - CVE-2018-20033

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to deny the acquisition of a valid license for legal use of the product.

NOTE: There are still three other advisories published by Schneider on Tuesday that have not been reported by NCCIC-ICS; all for Modicon controllers. I will address these on Saturday.;

AVEVA Advisory

This advisory describes the same four vulnerabilities reported above, this time in the AVEVA Vijeo Citect and Citect SCADA Floating License Manager. These vulnerabilities have not yet been reported by AVEVA. A new version is available from Schneider to mitigate the vulnerabilities.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to deny the acquisition of a valid license for legal use of the product.

SIMATIC Advisory

This advisory describes three vulnerabilities in the Siemens SIMATIC RF6XXR. The vulnerabilities are in older, third-party SSL and TLS applications still in use by these products. The vulnerabilities were reported by Wendy Parrington from United Utilities. Siemens reports that newer versions mitigate the vulnerabilities.

The three reported vulnerabilities are:

• Improper input validation - CVE-2011-3389; and

• Cryptographic issues (2) - CVE-2016-6329 and CVE-2013-0169

NCCIC-ICS reports that an uncharacterized attacker could use publicly available exploits (two of these are older, well recognized vulnerabilities) to remotely exploit the vulnerabilities to allow access to sensitive information.

TIA Portal Advisory

This advisory describes an improper access control vulnerability in the Siemens TIA Administrator (TIA Portal). The vulnerability was reported (with proof of concept code) by Joseph Bingham of Tenable. Siemens has an update that mitigates the vulnerability. There is no indication that Bingham has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an execution of some commands without proper authentication.

SIMATIC WinCC Advisory

This advisory describes an unrestricted upload of file with dangerous type vulnerability in the Siemens SIMATIC WinCC and SIMATIC PCS7 devices. The vulnerability was reported by Xuchen Zhu from ZheJiang Guoli Security Technology. Siemens has updates available that mitigates the vulnerability. There is no indication that Xuchen has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to cause a denial-of-service condition on the affected service or device. The Siemens advisory notes that the attacker has to be authenticated with a valid user account.

NOTE: There is still one new advisory that Siemens published on Tuesday that has not been reported by NCCIC-ICS. I will cover it tomorrow.

Delta Industrial Advisory

This advisory describes two vulnerabilities in the Delta Electronics CNCSoft ScreenEditor. The vulnerability was reported by Natnael Samson (@NattiSamson) via ZDI. Delta has a new version that mitigates the vulnerabilities. There is no indication that Samson was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Heap-based buffer overflow - CVE-2019-10982; and

• Out-of-bounds read - CVE-2019-10992

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause buffer overflow conditions that may allow information disclosure, remote code execution, or crash the application.

Philips Advisory

This advisory describes a use of obsolete function vulnerability in the Philips Holter 2010 Plus, a 12-lead EKG analysis software program. The vulnerability is self-reported. Philips provides generic measures to mitigate the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit this vulnerability to lead to a product feature escalation.