Review – 2 Advisories Published – 2-6-24

Today, CISA’s NCCIC-ICS published two control system security advisories for products from HID.

Advisories

HID Advisory #1 - This advisory describes an improper authentication in the HID Reader Configuration Cards.

HID Advisory #2 - This advisory describes an improper authentication in the HID iCLASS SE and OMNIKEY card encoders and readers.

 

For more information on these vulnerabilities, including known and possible 3rd party implications, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-published-2-6-24 - subscription required. 

Review – 2 Advisories and 3 Updates Published – 6-1-23

Today, CISA’s NCCIC-ICS published two control system security advisories for products from HID Global and Advantech. They also updated three advisories for products from Hitachi Energy, Mitsubishi Electric, and Delta Electronics.

Advisories

HID Advisory - This advisory describes a modification of assumed mutable data in the HID SAFE using the optional External Visitor Manager portal.

Advantech Advisory - This advisory describes three vulnerabilities in the Advantech WebAccess/SCADA product.

Updates

Hitachi Update - This update provides additional information on an advisory that was originally published on April 6^th, 2021 and most recently updated on April 20^th, 2021.

Mitsubishi Update - This update provides additional information on an advisory that was originally published on November 29^th, 2022.

Delta Update - This update provides additional information on an advisory that was originally published on September 13^th, 2022 (not 9-19-22).

 

For more details about these advisories, including a brief discussion about CISA’s disclosure of vulnerabilities found inhouse – see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-and-3-updates-published - subscription required.