Review – Public ICS Disclosures – Week of 4-8-23 – Part 3

For Part 3, we have 35 vendor updates from Schneider (4) and Siemens (31). We also have a researcher report for products from Triangle Microworks. Finally, we have five exploits for products from Paradox Security, Palo Alto Networks, FortiGuard, Schneider Electric, and Franklin Fueling Systems.

Updates

Schneider Update #1 - Schneider published an update for their EcoStruxure™ Control Expert advisory that was originally published on January 10^th, 2023 and most recently updated on March 14^th, 2023.

Schneider Update #2 - Schneider published an update for their SCADAPack Workbench advisory that was originally published on March 28^th, 2023.

Schneider Update #3 - Schneider published an update for their CODESYS V3 Runtime that was originally published on January 11^th, 2022 and most recently updated on March 14^th, 2023.

Schneider Update #4 - Schneider published an update for their BadAlloc advisory that was originally published on November 9^th, 2021 and most recently updated on March 14^th, 2023.

Siemens Update #1 - Siemens published an update for their SNMP in Multiple Industrial Products advisory that was originally published on February 11^th, 2020 and most recently updated on June 14^th, 2022.

Siemens Update #2 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on July 12^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #3 - Siemens published an update for their SIMATIC WinCC advisory that was originally published on November 9^th, 2021 and most recently updated on July 12^th, 2022.

Siemens Update #4 - Siemens published an update for their Industrial Products advisory that was originally published on February 28^th, 2022 and most recently updated on July 12^th, 2022.

Siemens Update #5 - Siemens published an update for their Polarion ALM advisory that was originally published on December 13^th, 2022.

Siemens Update #6 - Siemens published an update for their RUGGEDCOM ROS-based V4 advisory that was originally published on November 8^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #7 - Siemens published an update for their PROFINET-IO (PNIO) stack advisory that was originally published on November 11^th, 2020 and most recently updated on June 14^th, 2022.

Siemens Update #8 - Siemens published an update for their OpenSSL component advisory that was originally published on June 14^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #9 - Siemens published an update for their SCALANCE advisory that was originally published on August 9^th, 2022 and most recently updated on January 10^th, 2023.

Siemens Update #10 - Siemens published an update for their Teamcenter Visualization and JT2Go advisory that was originally published on December 13^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #11 - Siemens published an update for their SCALANCE X-200 and X-300/X408 advisory that was originally published on September 14^th, 2021 and most recently updated on March 12^th, 2022.

Siemens Update #12 - Siemens published an update for their SIMATIC CP 343-1 Advanced/CP-443-1 advisory that was originally published on November 21^st, 2016 and most recently updated on December 10^th, 2019.

Siemens Update #13 - Siemens published an update for their Industrial Products advisory that was originally published on March 20^th, 2018 and most recently updated on January 10^th, 2023.

Siemens Update #14 - Siemens published an update for their SIMATIC S7-400 CPU advisory that was originally published on March 12^th, 2022 an most recently updated on August 9^th, 2022.

Siemens Update #15 - Siemens published an update for their Web Interface of SCALANCE and RUGGEDCOM Products advisory that was originally published on October 11^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #16 - Siemens published an update for their SIMATIC NET CP advisory that was originally published on September 14^th, 2021 and most recently updated on June 14^th, 2022.

Siemens Update #17 - Siemens published an update for their Webserver of Industrial Products advisory that was originally published on April 9^th, 2019 and most recently updated on January 10^th, 2023.

Siemens Update #18 - Siemens published an update for their Web Server Login Page of Industrial Controllers advisory that was originally published on November 8^th, 2022 and most recently updated on January 10^th, 2023.

Siemens Update #19 - Siemens published an update for their  TCP SACK PANIC advisory that was originally published on September 10^th, 2019 and most recently update on June 14^th, 2022.

Siemens Update #20 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on September 13^th, 2022 and most recently updated on November 8^th, 2022.

Siemens Update #21 - Siemens published an update for their PROFINET Stack advisory that was originally published on March 12^th, 2022 and most recently updated on February 14^th, 2023.

Siemens Update #22 - Siemens published an update for their SCALANCE advisory that was originally published on December 13^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #23 - Siemens published an update for their OpenSSL 3.0 advisory that was originally published on December 13^th, 2022.

Siemens Update #24 - Siemens published an update for their Industrial Products advisory that was originally published on December 13^th, 2022 and most recently updated on January 10^th, 2023.

Siemens Update #25 - Siemens published an update for their Industrial Real-Time Devices advisory that was originally published on October 8^th, 2019 and most recently updated on January 10^th, 2023.

Siemens Update #26 - Siemens published an update for their OPC Foundation advisory that was originally published on May 10^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #27 - Siemens published an update for their SCALANCE X advisory that was originally published on July 12^th, 2022.

Siemens Update #28 - Siemens published an update for their SIMATIC PCS 7 advisory that was originally published on February 11^th, 2020 and most recently updated on April 12^th, 2022.

Siemens Update #29 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on March 8^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #30 - Siemens published an update for their OpenSSL advisory that was originally published on February 8^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #31 - Siemens published an update for their VX-Works advisory that was originally published on March 14^th, 2020 and most recently updated on June 14^th, 2022.

Researcher Reports

Triangle Microworks Report - The Zero Day Initiative published a report that describes a remote code execution vulnerability in the Triangle Microworks SCADA Data Gateway.

Exploits

Paradox Security Exploit - Giorgi Dograshvili published an exploit for a code injection vulnerability in the Paradox IPR512 IP monitoring receiver.

Palo Alto Networks Exploit - OMURUGUR published an exploit for a stored cross-site scripting vulnerability in the Palo Alto Networks Cortex XSOAR product.

FortiGuard Exploit - Mohammed Adel published an exploit for an uncontrolled resource consumption vulnerability in the FortiGuard FortiRecorder.

Schneider Exploit - Parsa Rezaie Khiabanloo published an exploit for a directory traversal vulnerability in an inadequately identified (SCADA-vis?) Schneider product.

Franklin Fueling Exploit - Parsa Rezaie Khiabanloo published an exploit for an information disclosure vulnerability in the Franklin Fuel Systems TS-550.

 

For more details about these disclosures, including a brief summary of the changes made in the updates, please see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-015 - subscription required.

Review – Public ICS Disclosures – Week of 4-9-22 – Part 1 –

With this being the 2^nd Tuesday weekend, we will need two parts to look at all of the ICS disclosures. For Part 1 we have 23 vendor disclosures from ABB (3), Bentley (8), CODESYS, GE Healthcare, HMS, HPE, Palo Alto Networks (3), Phoenix Contact (3), Tanzu, and VMware. We also have five vendor updates from GE Healthcare, Hitachi Energy (2), and Palo Alto Networks (2). Then there are four researcher reports for products from PositiveGrid, and Delta Controls (3). Finally, we have three exploits for products from Franklin Fueling, Siemens, Spring.

Part 2 will look at the Schneider and Siemens disclosures published on Tuesday.

ABB Advisory #1 - ABB published an advisory discussing two vulnerabilities (one with known exploits) in their ARM600 M2M Gateway.

ABB Advisory #2 - ABB published an advisory describing a security bypass vulnerability in their Arctic Wireless Gateway.

ABB Advisory #3 - ABB published an advisory discussing the INCONTROLLER ICS attack tools.

Bentley Advisory #1 - Bentley published an advisory describing two vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #2 - Bentley published an advisory describing four vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #3 - Bentley published an advisory describing five vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #4 - Bentley published an advisory describing two vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #5 - Bentley published an advisory describing eleven vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #6 - Bentley published an advisory describing an out-of-bounds write vulnerability in their MicroStation and MicroStation-based applications.

Bentley Advisory #7 - Bentley published an advisory describing three vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #8 - Bentley published an advisory describing two vulnerabilities in their MicroStation and MicroStation-based applications.

CODESYS Advisory - CODESYS published an advisory discussing the INCONTROLLER ICS attack tools.

GE Healthcare Advisory - GE Healthcare published an advisory discussing the SpringShell vulnerability.

HMS Advisory - HMS published an advisory discussing the INFRA:HALT vulnerabilities.

HPE Advisory - HPE published an advisory describing a denial of service vulnerability in their Integrated Lights-Out 4 (iLO 4) products.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory describing an improper handling of exceptional conditions vulnerability in their PAN-OS product.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory describing a product disruption vulnerability in their Cortex XDR Agent.

Palo Alto Networks Advisory #3 - Palo Alto Networks published an advisory describing an information exposure through log files vulnerability in their Cortex XDR agent.

Phoenix Contact Advisory #1 - Phoenix Contact published an advisory discussing 56 vulnerabilities in their AXC F x152 LTS.

Phoenix Contact Advisory #2 - Phoenix Contact published an advisory discussing an infinite loop vulnerability in their FL MGUARD, TC MGUARD, mGuard Device Manager and FL WLAN devices.

Phoenix Contact Advisory #3 - Phoenix Contact published an advisory discussing an HTTP request smuggling vulnerability in their mGuard Device Manager.

Tanzu Advisory - Tanzu published an advisory describing a data binding rule vulnerability in their Spring Framework products.

NOTE: This is related to the SpringShell vulnerability.

VMware Advisory - VMware published an advisory describing a remote code execution vulnerability in their Cloud Director product.

GE Healthcare Update - GE Healthcare published an update discussing the DirtyPipe vulnerability.

Hitachi Energy Update #1 - Hitachi Energy published an update for their XMC20 advisory that was originally published on November 23^rd, 2021.

Hitachi Energy Update #2 - Hitachi Energy published an update for their FOX61x XMC20 advisory that was originally published on November 23^rd, 2021.

Palo Alto Networks Update #1 - Palo Alto Networks published an update for their OpenSSL advisory that was originally published on March 31^st, 2022.

Palo Alto Networks Update #2 - Palo Alto Networks published an update for their Spring Shell advisory that was originally published on March 31^st, 2022.

PositiveGrid Report - Tenable published a report list six vulnerabilities in the PositiveGrid Spark API.

Delta Controls Report - Zero Science Labs published three reports about vulnerabilities in the Delta Controls enteliTOUCH building controllers.

Franklin Fueling Exploit - Momen Eldawakhly published an exploit for a local file inclusion vulnerability in the Franklin Fueling Systems Colibri Controller Module.

Siemens Exploit - Sec-consult published an exploit for two vulnerabilities in the Siemens A8000 CP-8050/CP-8031 SICAM WEB.

SpringShell Exploit - Mike Pickard published an exploit for the SpringShell vulnerability.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-3c2 - subscription required.