Review – 4 Advisories Published – 2-17-26

Today CISA published four control system security advisories for products from Honeywell, GE Vernova, Delta Electronics, and Siemens.

Advisories

Honeywell Advisory - This advisory describes a missing authentication for critical function vulnerability in the Honeywell CCTV Products.

GE Advisory - This advisory describes two vulnerabilities in the Vernova Enervista UR Setup tool.

Delta Advisory - This advisory describes a stack-based buffer overflow vulnerability in the Delta ASDA-Soft configuration software.

NOTE: I briefly discussed this vulnerability on February 7^th, 2026.

Siemens Advisory - This advisory that describes six vulnerabilities in their Simcenter Femap and Nastran products.

NOTE: I briefly discussed these vulnerabilities on February 14^th, 2026.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-2-17-26 - subscription required.

Review – Public ICS Disclosures – Week of 9-6-25 – Part 1

This week we have bulk vendor disclosures HP (6). There are also 12 vendor disclosures from Beckhoff, Bender (2), Delta Electronics, GE Vernova, Hitachi Energy, HPE (3), NI (2), and Palo Alto Networks.

Bulk Vendor Disclosures – HP

Intel UPLR2 Xeon Processor BIOS Security Updates,

Intel 2025.1 IPU – BIOS February 2025 Security Update,

AMD SMM Vulnerabilities February 2025 Security Update,

HP Hotkey Support – Escalation of Privilege,

Intel Core Ultra Processor Firmware Security Update, and

Poly Lens Desktop Application – Privilege Escalation,

Advisories

Beckhoff Advisory - Beckhoff published an advisory that describes a deserialization of untrusted data vulnerability in their TwinCAT 3 Engineering product.

Bender Advisory #1 - CERT-VDE published an advisory that describes an insufficiently protected credentials vulnerability in the Bender charge controller products.

Bender Advisory #2 - CERT-VDE published an advisory that describes a cleartext transmission of sensitive information vulnerability in the Bender charge controller products.

Delta Advisory - Delta published an advisory that describes two path traversal vulnerabilities in their DIALink product.

GE Advisory - GE published an advisory that discusses four vulnerabilities in their  Control Server, OTArmor, and Baseline Security Center (BSC) products.

Hitachi Energy Advisory - Hitachi Energy published an advisory that discusses seven vulnerabilities (one with publicly available exploit) in their RTU500 series product.

HPE Advisory #1 - HPE published an advisory that discusses two vulnerabilities (one with publicly available exploit) in their Telco Unified Correlation and Automation (UCA) product.

HPE Advisory #2 - HPE published an advisory that discusses two vulnerabilities in their Intelligent Assurance Using Apache product.

HPE Advisory #3 - HPE published an advisory that discusses two vulnerabilities in their Telco Intelligent Assurance product.

NI Advisory #1 - NI published an advisory that describes a path traversal vulnerability in their USI Registration tool for DataPlugins.

NI Advisory #2 - NI published an advisory that describes a relative path traversal vulnerability in their Digilent WaveForms product.

PAN Advisory #1 - PAN published an advisory that discusses eight vulnerabilities in their Prisma Access Browser.

PAN Advisory #2 - PAN published an advisory that describes an exposure of sensitive information to an unauthorized control sphere vulnerability in their User-ID Credential Agent.

PAN Advisory #3 - PAN published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Cortex XDR Microsoft 365 Defender Pack.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-9-97a - subscription required.

Review – 6 Advisories and 3 Updates Published – 8-28-25

Today CISA’s NCCIC-ICS published six control system security advisories for products from GE Vernova, Delta Electronics (2), Schneider Electric, and Mitsubishi Electric (2). The updated three advisories for products from Hitachi Energy and Mitsubishi Electric.

Advisories

GE Advisory - This advisory describes an uncontrolled search path element vulnerability in the GE CIMPLICITY HMI/SCADA software.

Delta Advisory #1 - This advisory describes two vulnerabilities in the Delta COMMGR software management     program.

Delta Advisory #2 - This advisory describes an out-of-bounds write vulnerability in the Delta CNCSoft-G2 CNC solution.

Schneider Advisory - This advisory describes an improper privilege management vulnerability in the Schneider Saitel DR RTU and Saitel DP RTU.

NOTE: I briefly discussed this vulnerability on August 17^th, 2025.

Mitsubishi Advisory #1 - This advisory describes a cleartext transmission of sensitive information vulnerability in their MELSEC iQ-F Series CPU modules.

Mitsubishi Advisory #2 - This advisory describes a missing authentication for critical function vulnerability in their MELSEC iQ-F Series CPU modules.

Updates

Hitachi Energy Update - This update provides additional information on the Relion 670/650 advisory that was originally published on July 3^rd, 2025.

Mitsubishi Update #1 - This update provides additional information on the Iconics Digital Solutions advisory that was originally published on May 20^th, 2025, and most recently updated on August 7^th, 2025.

NOTE: I briefly discussed the revised Mitsubishi advisory that underlies this update on August 9th.

Mitsubishi Update #2 - This update provides additional information on the Multiple FA Engineering Software Products advisory that was originally published on May 14^th, 2024, and most recently updated on May 15^th, 2025.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-3-updates-published-4b9 - subscription required.

Review – Public ICS Disclosures – Week of 5-17-25 – Part 2

For Part 2 we have five vendor updates from Broadcom, GE Vernova, HPE (2), and Siemens. There are also eight researcher reports for vulnerabilities in products from ABB (7) and eCharge.

Updates

Broadcom Update - Broadcom published an update for their curl/Libcurl advisory that was originally published on December 14^th, 2016.

GE Vernova Update - GE published an update for their WorkstationST EGD Configuration Server advisory that was originally published on September 24^th, 2024, and most recently updated on November 1^st, 2024.

HPE Update #1 - HPE published an update for their ProLiant DL/ML, MicroServer, Synergy and Edgeline Servers advisory that was originally published on May 12^th, 2025.

HPE Update #2 - HPE published an update for their ProLiant DL/ML/XL, Alletra, Edgeline and Synergy Servers advisory that was originally published on May 13^th, 2025.

Siemens Update - Siemens published an update for their Mendix OIDC SSO Module advisory that was originally published on May 13^th, 2025.

Researcher Reports

ABB Cylon BACnet Report - Zero Science published a report that describes an out-of-bounds write vulnerability in the ABB Cylon BACnet MS/TP Kernel Module.

ABB Cylon FLXeon Reports - Zero Science published six reports describing individual vulnerabilities (with publicly available exploits) in the ABB Cylon FLXeon product.

eCharge Report - SEC Consult published a report describing seven vulnerabilities in the eCharge Hardy Barth cPH2 and cPP2 charging stations.

 

For more information on these disclosures, including a summary of changes made in updates and links to exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-a55 - subscription required.

Review – Public ICS Disclosures – Week of 4-12-25

This week we have 14 vendor disclosures from ads-tech, Broadcom, Delta Electronics, GE Vernova (2), HP, HPE (2), Philips, Rockwell Automation, SEL (3), and WAGO. There are two vendor updates from Broadcom and Siemens. We also have three researcher reports for vulnerabilities in products from Eclipse. Finally, we have two exploits for products from Ruckus and FortiGuard.

Advisories

Ads-tech Advisory - CERT-VDE published an advisory that discusses three vulnerabilities (two with publicly available exploits) in the ads-tech IRF products.

Broadcom Advisory - Broadcom published an advisory that describes an input validation vulnerability in multiple Brocade products.

Delta Advisory - Delta published an advisory that describes three vulnerabilities in their ISPsoft product.

GE Advisory #1 - GE Vernova published an advisory that discusses four vulnerabilities in their NetworkST4 devices and Remote Operations Offering products.

GE Advisory #2 - GE Vernova published an advisory that discusses three vulnerabilities (all three listed in CISA’s KEV catalog) in unspecified GE products.

HP Advisory - HP published an advisory that describes a link following vulnerability in their Touchpoint Analytics Service.

HPE Advisory #1 - HPE published an advisory that describes an unauthorized access vulnerability in their Performance Cluster Manager.

HPE Advisory #2 - HPE published an advisory that describes an unauthorized access vulnerability in their Cray Data Virtualization Service.

Philips Advisory - Philips published an advisory that discusses a use after free vulnerability (with publicly available exploit) in multiple Philips products.

Rockwell Advisory - Rockwell published an advisory that describes two vulnerabilities in their ThinManager product.

SEL Advisory #1 - SEL published a software update notice that includes cybersecurity enhancements for their SEL-5032 acSELerator Architect Software.

SEL Advisory #2 - SEL published a software update notice that includes cybersecurity enhancements for their SEL-5702 Synchrowave Operations product.

SEL Advisory #3 - SEL published a software update notice that includes cybersecurity enhancements for their SEL-5231 SEL Configuration API.

WAGO Advisory - CERT-VDE published an advisory that discusses the Year 2038 problem.

Updates

Broadcom Update - Broadcom published an update for their Fabric OS advisory that was originally published on September 26^th, 2034, and most recently updated on February 27^th, 2025.

Siemens Update - Siemens published an update for their Industrial Edge Device Kit advisory that was originally published on April 8^th, 2025.

Researcher Reports

Eclipse Reports - Cisco Talos published three reports about individual vulnerabilities in the Eclipse ThreadX NetX Duo HTTP server.

Exploits

Ruckus Exploit - Korelogic published an exploit for an undocumented backdoor vulnerability in the Ruckus IoT Controller.

FortiGuard Exploit - Zach Hanley published a Metasploit module for an improper authentication vulnerability (listed in CISA’s KEV catalog) in multiple FortiGuard products.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-971 - subscription required.

Review – Public ICS Disclosures – Week of 3-8-25 – Part 2

For Part 2 we have three additional vendor disclosures from SEL, Sick, and Zyxel. There are also 21 vendor updates for products from Broadcom, HP, HPE, Schneider (2), and Siemens (16). Finally, we have six exploits for vulnerabilities in products from ABB (2), Foundstone, GE, WinTr, and Yokogawa.

Advisories

SEL Advisory - SEL published an update notice for their SEL-5032 acSELerator Architect Software that included a cybersecurity enhancement.

Sick Advisory - Sick published an advisory that describes three vulnerabilities in their SICK DL100-2xxxxxxx.

Zyxel Advisory - Zyxel published an advisory that describes three OS command injection vulnerabilities in multiple Zyxel product lines.

Updates

Broadcom Update - Broadcom published an update for their Brocade ASCG Vulnerability advisory that was originally published on January 7^th, 2025, and most recently updated on February 27^th, 2025.

HP Update - HP published an update for their HP LaserJet Pro advisory that was originally published on February 14^th, 2025.

HPE Update - HPE published an update for their Aruba Networking Access Points advisory that was originally published on August 3^rd, 2024, and most recently updated on August 15^th, 2024.

Schneider Update #1 - Schneider published an update for their Modicon M241 advisory that was originally published on December 10^th, 2024.

Schneider Update #2 - Schneider published an update for their EcoStruxure Power Monitoring Expert advisory that was originally published on October 8^th, 2024.

Siemens Update #1 - Siemens published an update for their User Management Component advisory that was originally published on December 16^th, 2024.

Siemens Update #2 - Siemens published an update for their n SIMATIC S7-1500 advisory that was originally published on October 8^th, 2024, and most recently updated on January 14^th, 2025.

Siemens Update #3 - Siemens published an update for their Fortigate NGFW advisory that was originally published on March 12^th, 2024, and most recently updated on February 11^th, 2025.

Siemens Update #4 - Siemens published an update for their Fortigate NGFW advisory that was originally published on February 11^th, 2025.

Siemens Update #5 - Siemens published an update for their SIPROTEC 5 advisory that was originally published on February 11^th, 2025.

Siemens Update #6 - Siemens published an update for their Radius Protocol advisory that was originally published on July 9^th, 2024, and most recently updated on January 14^th, 2025.

Siemens Update #7 - Siemens published an update for their Radius Protocol advisory that was originally published on July 9^th, 2024, and most recently updated on January 14^th, 2025.

Siemens Update #8 - Siemens published an update for their SegmentSmack advisory that was originally published on April 14^th, 2020, and most recently updated on January 14^th, 2025.

Siemens Update #9 - Siemens published an update for their DHCP Client advisory that was originally published on November 12^th, 2019, and most recently updated on February 13^th, 2024.

Siemens Update #10 - Siemens published an update for their GNU/Linux subsystem advisory that was originally published on December 12^th, 2022, and most recently updated February 11^th, 2025.

Siemens Update #11 - Siemens published an update for their GNU/Linux subsystem advisory that was originally published on April 9^th, 2024, and most recently updated on February 11^th, 2025.

Siemens Update #12 - Siemens published an update for their Nucleus RTOS advisory that was originally published on April 13^th, 2021, and most recently updated on February 13^th, 2023.

Siemens Update #13 - Siemens published an update for their SIMATIC Products Webserver advisory that was originally published on February 11^th, 2025.

Siemens Update #14 - Siemens published an update for their SIPROTEC 5 Webserver advisory that was originally published on January 14^th, 2025, and most recently updated on February 11^th, 2025.

Siemens Update #15 - Siemens published an update for their SIMATIC S7-1500 CPUs Webserver advisory that was originally published on October 8^th, 2024, and most recently updated on January 14^th, 2025.

Siemens Update #16 - Siemens published an update for their User Management Component advisory that was originally published on September 10^th, 2024, and most updated on January 14^th, 2025.

Exploits

ABB Exploit #1 - Indoushka published an exploit for two vulnerabilities in the ABB AC500.

ABB Exploit #2 - Indoushka published an exploit for a shell upload vulnerability in the ABB Cylon Aspect.

Foundstone Exploit - Ahmet Ümit Bayram published an exploit for a buffer overflow vulnerability in the Foundstone SuperScan product.

GE Proficy Exploit - Indoushka published an exploit for a directory traversal vulnerability in the GE Proficy Cimplicity 7 product.

VMware Exploit - Indoushka published an exploit for an ASP.NET misconfiguration: use of identity impersonation vulnerability in the VMware vCenter Server product.

WinTR Exploit - Ahmet Ümit Bayram published an exploit for a command injection vulnerability in the WinTR Scada product.

Yokogawa Exploit - Indoushka published an exploit for an improper restriction of operation within the bounds of a memory buffer vulnerability in the Yokogawa CENTUM CS 3000.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-3-fdf - subscription required.

Review – Public ICS Disclosure – Week of 2-3-24

This week we have 22 vendor disclosures from Badger, B&R Automation (2), FortiGuard (4), GE Vernova, Hitachi (2), HPE, Meinberg, Pilz, SEL, Sharp, VMware, WatchGuard (4), and Western Digital. There is also one update from HP. Finally, we have three exploits for products from Forta, Milesight, and Zyxel.

Advisories

Badger Advisory - Incibe-CERT published an advisory that describes four vulnerabilities in their Monitool product.

B&R Advisory #1 - B&R published an advisory that describes a use of broken or risky cryptographic algorithm in their Runtime FTP server component.

B&R Advisory #2 - B&R published an advisory that describes a cross-site scripting vulnerability in their SDM Web interface.

FortiGuard Advisory #1 - FortiGuard published an advisory that describes an out-of-bounds write vulnerability (listed in CISA’s Known Exploit Exploits Catalog) in their FortiOS.

FortiGuard Advisory #2 - FortiGuard published an advisory that describes a lack of certificate validation vulnerability in their FortiOS.

FortiGuard Advisory #3 - FortiGuard published an advisory that describes a use of externally-controlled format string vulnerability.

FortiGuard Advisory #4 - FortiGuard published an advisory that discusses an uncontrolled resource consumption vulnerability (which is listed in CISA’s KEV) in their FortiOS and FortiProxy products.

GE Advisory - GE published an advisory that discusses a use of externally controlled format string vulnerability in their NetworkST4 and Remote Operations Offering.

Hitachi Advisory #1 - Hitachi published an advisory that discusses ten vulnerabilities in multiple Hitachi products.

Hitachi Advisory #2 - Hitachi published an advisory that discusses two vulnerabilities in their JP1 product.

HPE Advisory - HPE published an advisory that discusses 17 vulnerabilities in their Unified OSS Console Assurance Monitoring (UOCAM).  

Meinberg Advisory - Meinberg published an advisory that discusses 18 vulnerabilities in their LANTIME-Firmware.

Pilz Advisory - Pilz published an advisory that discusses six vulnerabilities.

SEL Advisory - SEL published an update notice for a new version of their SEL-5025 Secure Port Software which fixes two security issues.

Sharp Advisory - Sharp published an advisory that describes a path traversal vulnerability in multiple Sharp public display products.

VMware Advisory - VMware has published an advisory that describes five vulnerabilities in their VMware Aria Operations for Networks product.

WatchGuard Advisory #1 - WatchGuard published an advisory that describes a memory corruption vulnerability in their Endpoint products.

WatchGuard Advisory #2 - WatchGuard published an advisory that describes an out-of-bounds write vulnerability in their Endpoint products.

WatchGuard Advisory #3 - WatchGuard published an advisory that describes an arbitrary kernel read vulnerability in their Endpoint products.

WatchGuard Advisory #4 - WatchGuard published an advisory that discusses four Ivanti vulnerabilities.

Western Digital Advisory - Western Digital published an advisory that describes two vulnerabilities in their My Cloud, WD Cloud, and SanDisk ibi products.

Updates

HP Update - HP published an update for their UC Software advisory that was originally published on January 9^th, 2024.

Exploits

Forta Exploit - James Horseman published an Metasploit module for a forced browsing vulnerability in the Forta GoAnywhere MFT.

Zyxel Exploit - Marco Ivaldi published an exploit for an improper input validation vulnerability in multiple Zyxel products.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-2-3 - subscription required.

Review – Public ICS Disclosures – Week of 8-26-23

This week we have 53 vendor disclosures from Aruba Networks, Bosch, Broadcom (24), Festo, i-Pro, GE Gas Power, Hitachi, Hitachi Energy, HPE, Moxa, SEL (5), Splunk (11), Texas Instruments (2), and VMware (2). There are also three vendor updates from Broadcom (2) and Mitsubishi. Finally, we have four researcher reports for products from Unified Automation and Tinycontrol (3).

Advisories

Aruba Advisory - Aruba published an advisory that describes three vulnerabilities in their ArubaOS switch products.

Bosch Advisory - Bosch published an advisory that describes a code injection vulnerability in their RTS VLink Virtual Matrix Software.

Broadcom Advisories - Broadcom published 24 advisories for vulnerabilities in various Brocade products.

Festo Advisories - CERT-VDE published an advisory that discusses a cross-site scripting vulnerability in the Festo LX Appliance.

i-Pro Advisory - JP-CERT published an advisory that describes four vulnerabilities in the i-Pro VI Web Client.

GE Advisory - GE published an advisory that describes a default administrator vulnerability in their Nexus OTArmor product.

Hitachi Advisory - Hitachi published an advisory that describes an insufficient logging vulnerability in their HiRDB servers.

Hitachi Energy Advisory - Hitachi published an advisory that discusses four vulnerabilities in their Lumada APM Edge product.

HPE Advisory - HPE published an advisory that discusses 48 vulnerabilities in their SANnav Management Software.

Moxa Advisory - Moxa published an advisory that describes five vulnerabilities in their MXsecurity Series products.

SEL Advisories - SEL published five advisories. These advisories are only available to registered owners.

Splunk Advisories - Splunk published 11 advisories for various products.

TI Advisory #1 - TI published an advisory that discusses a Bluetooth reconnection vulnerability in multiple TI products.

TI Advisory #2 - TI published an advisory that discusses a failure to connect Bluetooth devices vulnerability in multiple TI products.

VMware Advisory #1 - VMware published an advisory that describes two vulnerabilities in their Aria Operations for Networks product.

VMware Advisory #2 - VMware published an advisory that discusses a SAML token signature bypass vulnerability in their Tools product.

Updates

Broadcom Update #1 - Broadcom published an update for their ASN1_STRING structure advisory that was originally published on September 13^th, 2022.

Broadcom Update #2 - Broadcom published an update for their Apache Commons Text advisory that was originally published on October 20^th, 2022.

Mitsubishi Update - Mitsubishi published an update for their BACnet® secure connect function of GENESIS64 advisory that was originally published on March 7^th, 2023.

Researcher Reports

Unified Automation Report - The Zero Day Initiative published a report describing an integer overflow vulnerability in the Unified Automation UaGateway.

Tinycontrol Reports - Zero Science Lab published three reports about individual vulnerabilities in the Tinycontrol LAN Controller.

 

For more details about these disclosures, including links to 3^rd party reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-c47 - subscription required.

Review – 4 Advisories Published – 8-31-23

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Digi International, PTC, GE Digital, and ARDEREG.

Advisories

Digi Advisory - This advisory describes a use of password hash instead of password for authentication vulnerability in the Digi RealPort Protocol.

PTC Advisory - This advisory describes four vulnerabilities in the PTC Kepware KepServerEX.

GE Advisory - This advisory describes a process control vulnerability in the GE CIMPLICITY 2023 product.

ARDEREG Advisory - This advisory describes an SQL injection vulnerability in the ARDEREG Sistemas SCADA.

 

For more details on these advisories, including links to researcher reports and a down-the-rabbit-hole look at the Digi advisory, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-8-31-23 - subscription required.

Review – 4 Advisories Published – 3-14-23

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Aveva, GE Digital, Autodesk and Omron.

Advisories

Aveva Advisory - This advisory describes an improper authorization vulnerability in the Aveva Plant SCADA and AVEVA Telemetry Server products.

GE Advisory - This advisory describes a code injection vulnerability in the GE Proficy iFIX product.

Autodesk Advisory - This advisory describes three vulnerabilities in the Autodesk FBX SDK software.

Omron Advisory - This advisory describes an improper access control vulnerability in the Omron SYSMAC CJ- and CS-series programmable logic controller.

 

For more details about these advisories, including a discussion about a discrepancy in the reported third-party vulnerability to the Autodesk vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-3-14-23 - subscription required.

Review – Public ICS Disclosures – Week of 1-14-23

This week we have twelve vendor disclosures from Campbell Scientific, Contec, HIMA, HP, Medtronic, and Wireshark (7). We also have two researcher disclosures for products from Mitsubishi and GE,

Vendor Disclosures

Campbell Advisory - INCIBE-CERT published an advisory that describes an exposure of sensitive information to unauthorized actor vulnerability in the Campbell dataloggers.

Contec Advisory - Contec published an advisory that describes SQL injection vulnerabilities in their CONPROSYS HMI System.

HIMA Advisory - CERT-VDE published an advisory that describes an unquoted Windows search path vulnerability in multiple HIMA X-OPC and X-OTS products.

HP Advisory - HP published an advisory that discusses eight vulnerabilities in multiple HP products.

Medtronic Advisory - Medtronic published an end-of-life notice for their superDimension™ navigation system.

Wireshark Advisory #1 - Wireshark published an advisory that describes a packet injection vulnerability in their EAP dissector.

Wireshark Advisory #2 - Wireshark published an advisory that describes a memory leak vulnerability in their NFS dissector.

Wireshark Advisory #3 - Wireshark published an advisory that describes a denial of service vulnerability in their Dissection engine.

Wireshark Advisory #4 - Wireshark published an advisory that describes a denial of service vulnerability in their GNW dissector.

Wireshark Advisory #5 - Wireshark published an advisory that describes a denial of service vulnerability in their iSCSI dissector.

Wireshark Advisory #6 - Wireshark published an advisory that describes an excessive loop vulnerability in multiple dissectors.

Wireshark Advisory #7 - Wireshark published an advisory that describes a denial of service vulnerability in their TIPC dissector.

Researcher Reports

Mitsubishi Report - CISCO Talos published a report that describes an authentication bypass vulnerability in the Mitsubishi MELSEC iQ-FX5U webserver.

GE Report - Claroty published a report that describes five vulnerabilities in the GE Proficy Historian. The report contains proof-of-concept code.

 

For more details about these disclosures, including links to third-party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-6c3 - subscription required.

Review – 3 Advisories and 1 Update Published – 1-17-23

Today, CISA’s NCCIC-ICS published three control system security advisories for products from Siemens, Mitsubishi Electric, and GE Digital. They also updated an advisory for products from Contec.

Advisories

Siemens Advisory - This advisory discusses twelve vulnerabilities in the Siemens SINEC Infrastructure Network Services (INS).

NOTE: I briefly discussed these vulnerabilities on Sunday.

Mitsubishi Advisory - This advisory describes a predictable seed in the PRNG of Mitsubishi MELSEC iQ-F and iQ-R Series products.

GE Advisory - This advisory describes five vulnerabilities in the GE Digital Proficy Historian.

Update

Contec Update - This update provides additional information on an advisory that was originally published on December 13^th, 2022.

NOTE: This update is based upon an update of the JP-CERT advisory that was published on January 10^th.

 

For more details about these advisories, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-1-update-published-f4a - subscription required.

Review – Public ICS Disclosures – Week of 12-10-22 – Part 1

On this Saturday after Cyber Tuesday, for Part 1 we have nineteen vendor disclosures from Aruba Networks, Contec, Eaton, Festo, FortiGuard Labs, GE Gas Power, Hitachi Energy (4), HP (7), IFM Electronic, and Phoenix Contact.

Vendor Disclosures

Aruba Advisory - Aruba published an advisory that describes thirteen vulnerabilities in their EdgeConnect Enterprise Orchestrator.

CONTEC Advisory - JPCERT published an advisory that describes four vulnerabilities in the CONTEC SolarView Compact. CONTEC has new versions that mitigate the vulnerabilities.

Eaton Advisory - Eaton published an advisory that describes two vulnerabilities in their Intelligent Power Protector (IPP) software.

Festo Advisory - CERT-VDE published an advisory that discusses a link following vulnerability in multiple Festo products.

FortiGuard Advisory - FortiGuard published an advisory that describes a heap-based buffer overflow vulnerability in their FortiOS SSL-VPN.

GE Gas Power - GE published an advisory that discusses two vulnerabilities in FortiOS.

Hitachi Energy Advisory #1 - Hitachi published an advisory that describes five vulnerabilities in their UNEM Product.

Hitachi Energy Advisory #2 - Hitachi published an advisory that describes five vulnerabilities in their FOXMAN-UN Product.

Hitachi Energy Advisory #3 - Hitachi published an advisory that discusses three vulnerabilities in their Lumada Asset Performance Management (APM) Product.

Hitachi Energy Advisory #4 - Hitachi published an advisory that describes an access control vulnerability in their Lumada APM Product. Hitachi

HP Advisory #1 - HP published an advisory that describes five vulnerabilities (one third-party) in their Security Manager product.

HP Advisory #2 - HP published an advisory that discusses five vulnerabilities in their AMD Client UEFI Firmware.

HP Advisory #3 - HP published an advisory that describes a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in their PC BIOS.

HP Advisory #4 - HP published an advisory that discusses an improper restriction of operations within  the bounds of a memory buffer vulnerability in a wide variety of their PCs.

HP Advisory #5 - HP published an advisory that discusses the Text4Shell vulnerability in their Teradici Cloud Access Connector.

HP Advisory #6 - HP published an advisory that describes a privilege escalation vulnerability in their HyperX NGENUITY software.

HP Advisory #7 - HP published an advisory that describes a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in their AMI UEFI Firmware.

IFM Advisory - CERT-VDE published an advisory that describes a weak password recovery vulnerability in the IFM moneo appliance.

Phoenix Contact Advisory - Phoenix Contact published an advisory that discusses two vulnerabilities in their PROFINET SDK product.

 

For more information on these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-9ea - subscription required.

Review – 3 Advisories Published – 2-22-22

Happy Twosday! Today, CISA’s NCCIC-ICS published three control system security advisories for products from WIN-911 and GE (2).

WIN-911 Advisory - This advisory describes two incorrect default permissions vulnerabilities in the WIN-911 2021 alarm notification platform.

NOTE: The WIN-911 advisory provides a good explanation of the how these two vulnerabilities work.

GE Advisory #1 - This advisory describes a clear-text transmission of sensitive information vulnerability in the GE Proficy CIMPLICITY HMI and SCADA platform.

GE Advisory #2 - This advisory describes an improper privilege management vulnerability in the GE Proficy CIMPLICITY HMI and SCADA platform.

 

For additional details about these vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-published-2-22-22 - subscription required.

Review - Public ICS Disclosures - Log4Shell Advisories – 12-14-21

Today I am taking an out-of-band look at ICS vendor disclosures for the Log4Shell vulnerability. I have not looked at my list of medical device vendors for this post, I may look at those later this week. For this post we have 20 vendor disclosures from Aruba, Broadcom, CODESYS, Dell, GE (2), HMS (5), HPE, Hitachi Energy, Johnson Controls, QNAP, Rockwell, Ruckus, SonicWall (update), VMware and Wind River. I am using a slightly different format for this post, separating advisories into four groups; not affected, still looking, affected products list, and mitigation.

Not Affected

CODESYS published a notice that none of their products are affected.

HMS published an advisory reporting that their Argos and HMS Hub web services are not affected.

HMS published an advisory reporting that their Ixxat products are not affected.

Vendors Still Looking at the Vulnerability

GE published a generic Log4Shell advisory.

GE published an advisory.

HMS published an advisory for their Anybus product line.

HMS published an advisory for their WEBfactory product line.

Hitachi Energy published an advisory.

Meinberg published an advisory.

QNAP published an advisory.

Johnson Controls published an advisory.

Vendors With Affected Product Lists

Aruba published an advisory.

HPE published an advisory.

Ruckus published an advisory.  

SonicWall published an update for an advisory that was originally published on December 10^th, 2021.

Wind River published an advisory.

Vendors With Mitigation Measures

Broadcom published an advisory.

Dell published an advisory for their Dell Wyse Management Suite.

HMS published an advisory for their EWON products.

Rockwell published an advisory.

VMware published an update for their advisory was originally published on December 10^th, 2021.

For more details about these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-log4shell - subscription required.

Public ICS Disclosures – Week of 2-6-21 – Part 1

This week we have four vendor disclosures from B&R Automation, Dell, GE Healthcare, and Rockwell. There is also an update from Rockwell.

B&R Advisory

B&R published an advisory discussing the CodeMeter vulnerabilities. B&R provides a list of affected products and links to updated versions that mitigate the vulnerabilities.

Dell Advisory

Dell published an advisory describing three vulnerabilities in their AOS SD-WAN. These are third-party vulnerabilities (ArubaOS). Dell has new versions that mitigate the vulnerabilities.

The three reported vulnerabilities are:

• Multiple buffer overflows - CVE-2020-24633,

• Unauthenticated remote command injection - CVE-2020-24634, and

• Secureboot bypass - CVE-2020-10713

GE Healthcare Advisory

GE published an advisory describing a buffer overflow vulnerability in unnamed products. This is a third-party (SUDO) vulnerability. GE provides no mitigation measures on their public facing portal. There is a publicly available exploit for this vulnerability.

Rockwell Advisory

Rockwell published an advisory describing an IPv4 denial-of-service vulnerability in their Allen-Bradley MicroLogix 1100 Programmable Logic Controller. This vulnerability was reported by Talos. Rockwell has a firmware update that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

Rockwell Update

Rockwell published an update for their Ripple20 advisory. The new information includes adding the four new vulnerabilities reported by Treck on December 20^th, 2020.

Part 2

I will address the Siemens and Schneider advisories and updates from this week that were not covered by NCCIC-ICS is Part 2 of this post.

10 Advisories Published – 2-9-21

Today CISA’s NCCIC-ICS published ten control system security advisories for products from Siemens (8), Advantech, and GE Digital. NCCIC-ICS also published 12 advisory updates for products from Siemens that I will cover in a separate post tomorrow.

DIGSI 4 Advisory

This advisory describes an incorrect default permissions vulnerability in the Siemens DIGSI 4 product. The vulnerability was reported by Rich Davy from ECSC Group. Siemens has newer versions that mitigate the vulnerability. There is no indication that Davy has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow a low privileged attacker to execute arbitrary code with SYSTEM privileges.

WinCC Advisory

This advisory describes an authentication bypass using an alternate path or channel vulnerability in the Siemens WinCC Graphics Designer. The vulnerability was reported by Enrique Murias Fernandez from Tecdesoft Automation. Siemens has an update that mitigates the vulnerability. There is no indication that Fernandez has been provided with an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker unauthenticated access to protected files.

SIMARIS Advisory

This advisory describes an incorrect default permissions vulnerability in the Siemens SIMARIS configuration electrical planning software. The vulnerability was reported by Rich Davy from ECSC Group. Siemens has provided generic workarounds for the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to gain persistence or escalate privileges within the system.

SCALANCE Advisory

This advisory describes an allocation of resources without limits or throttling in the Siemens SCALANCE W780 and W740 family. The vulnerability is self-reported. Siemens has a new version that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to cause a denial-of-service condition.

JT2Go Advisory

This advisory describes 21 vulnerabilities in the Siemens JT2Go and Teamcenter Visualization products. The vulnerabilities were reported by Michael DePlante (@izobashi), Francis Provencher {PRL}, and rgod via the Zero Day Initiative. Siemens has updates available that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The 21 reported vulnerabilities are:

• Out-of-bounds read (7) - CVE-2020-26998, CVE-2020-26999, CVE-2020-27002, CVE-2020-27004, CVE-2020-27007, CVE-2020-27008, and CVE-2020-28394,

• Improper restriction of operations within the bounds of a memory buffer (3) - CVE-2020-27000, CVE-2020-27006, and CVE-2021-25174,

• Stack-based buffer overflow (3) - CVE-2020-27001, CVE-2020-26989, and CVE-2021-25178,

• Untrusted pointer dereference (3) - CVE-2020-27003, CVE-2020-26991, and CVE-2021-25176,

• Out-of-bounds write - CVE-2020-27005,

• Type confusion (2) - CVE-2020-26990 and CVE-2021-25177,

• Incorrect type conversion or cast - CVE-2021-25175,

• Memory allocation with excessive size value - CVE-2021-25173

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to lead to arbitrary code execution.

TIA Advisory

This advisory describes an improper access control vulnerability in the Siemens TIA Portal and PCS neo products. The vulnerability was reported [link added 2-10-21 08:11 EST] by Will Dormann from CERT Coordination Center. Siemens has an update that mitigates the vulnerability. There is no indication that Dormann has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow local users to escalate privileges and execute code as a local SYSTEM user.

RUGGEDCOM Advisory

This advisory describes six vulnerabilities in the Siemens RUGGEDCOM ROX IIB products. Siemens is self-reporting these vulnerabilities. Siemens has an update that mitigates the vulnerabilities.

• Improper input validation - CVE-2018-12404,

• Null pointer dereference - CVE-2018-18508,

• Out-of-bounds write - CVE-2019-11745,

• Insufficient verification of data authenticity - CVE-2019-17006,

• Improper certificate validation - CVE-2019-17007, and

• Out-of-bounds read - CVE-2020-1763

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow the decryption of encrypted content, possible code execution, or cause a system crash, resulting in a denial-of-service condition.

SINEMA Advisory

This advisory describes a path traversal vulnerability in the Siemens SINEMA Server and SINEC NMS products. The vulnerability was reported by rgod via ZDI. Siemens has a new version that mitigates the vulnerability. There is no indication that rgod has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to  allow arbitrary code execution on an affected system.

Advantech Advisory

This advisory describes four vulnerabilities in the Advantech iView device management application. The vulnerability was reported by Anonymous and rgod via ZDI, and William Vu of Rapid7. Advantech has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• SQL injection (2) - CVE-2021-22654 and CVE-2021-22658,

• Path traversal - CVE-2021-22656, and

• Missing authentication for critical function - CVE-2021-22652

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to disclose information, escalate privileges to Administrator, perform an arbitrary file read, and remotely execute commands.

GE Digital Advisory

This advisory describes two incorrect permission assignment for critical resource vulnerability for the GE HMI/SCADA iFIX. The vulnerabilities were reported by William Knowles of Applied Risk. The GE Digital advisory also credits Sharon Brizinov of Claroty for reporting the three undescribed vulnerabilities, only one of which is apparently referenced in the NCCIC-ICS advisory. The Applied Risk advisory lists two vulnerabilities with significantly different CVSS v3 base scores; 7.8 for the Applied Risk advisory and 6.1 for the NCCIC-ICS advisory with minor differences in the vector strings.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to allow an attacker to escalate their privileges.

NOTE: I briefly discussed the GE Digital advisory this last weekend.

Other Siemens Advisory

Siemens also published one more advisory today. I will discuss that this weekend.

Public ICS Disclosure – Week of 1-30-21

This week we have four vendor disclosures from ABB, Belden, GE Digital, and Ruckus. There is also an update from Rockwell and Honeywell published an end-of-life notice.

ABB Advisory

ABB published an advisory describing a web-server denial of service vulnerability in their AC500 V2 products. The vulnerability was reported by Richard Thomas and Tom Chothia of the University of Birmingham. ABB has no mitigation measures for this vulnerability.

Belden Advisory

Belden published an advisory describing a denial of service vulnerability in the Hirschmann HiOS platform. The vulnerability was reported by the French Cybersecurity Agency (ANSSI). Belden has updates available that mitigate the vulnerability. There are no indications that the researchers have been provided an opportunity to verify the efficacy of the fix.

GE Advisory

GE published an advisory describing three unnamed vulnerabilities in their iFix HMI/SCADA product. The vulnerabilities were reported by Sharon Brizinov of Claroty and William Knowles with Applied Risk. GE has an upgrade that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Ruckus Advisory

Ruckus published an advisory describing a CLI passphrase vulnerability in their AP and ZD products. The vulnerability is apparently self-reported. No mitigation measures are described.

Rockwell Update

Rockwell published an update for the AENT Flex I/O Series B advisory that was originally published on October 12^th, 2020. The new information includes adding a sixth classic buffer overflow vulnerability, CVE-2020-6088.

NOTE: Talos published a report this week covering this vulnerability. It included proof-of-concept code.

Honeywell EOL Notice

Honeywell published an end-of-life notice for their Maxpro VMS/NVR products.

Public ICS Disclosures – Week of 11-14-20

This week we have six vendor disclosures from Beckhoff, ENDRESS+HAUSER (2), GE Grid (2), and Medtronic. We have one Ripple20 advisory update for products from Eaton. We also have a researcher report on vulnerabilities in products from Schneider. Finally, we have reports of exploits for products from Rockwell and the Netlogon vulnerability in Microsoft products.

Beckhoff Advisory

CERT-VDE published an advisory describing an incorrect default permissions vulnerability in the Beckhoff TwinCAT XAR product. The vulnerability was reported by Ayushman Dutta. Beckhoff has provided installation instructions to mitigate the vulnerability. There is no indication that Dutta has been provided an opportunity to verify the efficacy of the fix.

ENDRESS+HAUSER Advisories

CERT-VDE published an advisory describing an exposure of sensitive information to an unauthorized actor vulnerability in the ENDRESS+HAUSER Ecograph T products. The vulnerability was reported by Maxim Rupp. ENDRESS+HAUSER has provided generic workarounds to mitigate the vulnerability.

CERT-VDE published an advisory describing an improper privilege management vulnerability in the ENDRESS+HAUSER Ecograph T products. The vulnerability was reported by Maxim Rupp. ENDRESS+HAUSER has provided generic workarounds to mitigate the vulnerability.

GE Advisories

GE published an advisory for their Reason RT430/RT434. The advisory is only available to registered customers.

GE published an advisory for their Reason RT431. The advisory is only available to registered customers.

Medtronic Advisory

Medtronic published an advisory discussing the TiYunZong vulnerabilities found in the CT900 Samsung Android tablets used to run their Clinical Programmer Applications. A Chrome browser update is available to mitigate the vulnerabilities.

NOTE: I wonder what other vendors using Android products for access devices could be susceptible to these vulnerabilities?

Eaton Update

Eaton published an update for their Ripple20 advisory that was originally published on June 23^rd, 2020 and most recently updated on October 5^th, 2020. The new information includes adding the Uninterrupted Power Supply (UPSs) with ModbusMS card to the list of affected products.

Schneider Report

Trustwave published a report describing their research into vulnerabilities in the Schneider EcoStruxure Machine Expert and M221 PLC. The vulnerabilities were reported by Schneider on October 10^th, 2020. The report includes proof-of-concept code.

Rockwell Exploit

The Flashback team published a Metasploit module for vulnerabilities in the Rockwell FactoryTalk View SE SCADA product. These vulnerabilities were reported by CISA NCCIC-ICS on June 18^th, 2020.

Netlogon Exploit

West Shepherd published a proof-of-concept exploit for the Netlogon vulnerabilities reported by Microsoft.

NOTE: I have not seen this vulnerability reported in control system products, but it has been reported by medical device manufacturers (see for example BD).

2 Advisories Published – 9-22-20

 Today the CISA NCCIC-ICS published two control system security advisories for products from GE.

Reason S20 Advisory

This advisory describes two cross-site scripting vulnerabilities in the GE Reason S20 Ethernet Switch. The vulnerability was reported by IOActive. GE has newer firmware versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow unauthorized accounts manipulation and allow for remote code execution.

APM Advisory

This advisory describes two vulnerabilities in the GE Digital APM Classic data analysis tool. The vulnerability was reported by Guido Marilli of Accenture Security. GE has a new version that mitigates the vulnerabilities. There is no indication that Marilli has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Authorization bypass through user-controlled key - CVE-2020-16240, and

• Use of a one-way hash without a salt - CVE-2020-16244

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow access to sensitive information. The GE Digital advisory states that “GE believes exploitation of the Vulnerabilities is only possible if an attacker was first authenticated.”