Review – Public ICS Disclosures – Week of 3-7-26 – Part 2 -

For Part 2 we have additional 14 vendor disclosures from Delta Electronics, Janitza, Mitsubishi, Moxa (4), NI (2), Palo Alto Networks (3), Philips, and Ruckus. Part 3 is in the works.

Advisories

Delta Advisory - Delta published an advisory that describes two vulnerabilities in their COMMGR 2 product

Janitza Advisory - CERT-VDE published an advisory that describes four vulnerabilities in the Janitza UMG 96RM-E products.

Mitsubishi Advisory - Mitsubishi published an advisory that describes an improper validation of specified index, position, or offset vulnerability in their CNC Series products.

Moxa Advisory #1 - Moxa published an advisory that discusses a GNU argument injection vulnerability.

Moxa Advisory #2 - Moxa published an advisory that discusses three vulnerabilities in their DA Series products.

Moxa Advisory #3 - Moxa published an advisory that discusses three vulnerabilities in their DA Series products.

Moxa Advisory #4 - Moxa published an advisory that discusses an insufficient flow control management vulnerability in their DA Series products.

NI Advisory #1 - NI published an advisory that describes two out-of-bounds write vulnerabilities in their Digilent DASYLab product.

NI Advisory #2 - NI published an advisory that describes two out-of-bounds read vulnerabilities in their Digilent DASYLab product.

PAN Advisory #1 - PAN published an advisory that discusses eight vulnerabilities (one with publicly available exploits and listed in CISA’s KEV catalog) in their Prima Browser product.

PAN Advisory #2 - PAN published an advisory that describes an improper check for unusual or exceptional conditions vulnerability in their Cortex XDR Agent.

PAN Advisory #3 - PAN published an advisory that describes an exposure of sensitive information to an unauthorized control sphere in their Cortex XDR Broker VM product.

Philips Advisory - Philips published an advisory that discusses the Stryker cyberattack.

Ruckus Advisory - Ruckus published an advisory that discusses the AirSnitch vulnerabilities.

 

For more information on these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-3-194 - subscription required.

Review – Public ICS Disclosures – Week of 11-22-25 – Part 1

This week is a moderately busy disclosure week. For Part 1 we have 13 vendor disclosures from Carrier (3), Dassault Systems (2), Eaton, Hitachi, Janitza, Mitsubishi, Moxa (3), and Splunk.

Advisories

Carrier Advisory #1 - Carrier published an advisory that describes two vulnerabilities in the multiple Carrier and Automated Logic products.

Carrier Advisory #2 - Carrier published an advisory that describes an improper validation of array index vulnerability in multiple Carrier and Automated Logic products.

Carrier Advisory #3 - Carrier published an advisory that describes an improper input validation vulnerability in Carrier and Automated Logic Zone Controllers.

Dassault Advisory #1 - Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Product Manager.

Dassault Advisory #2 - Dassault published an advisory that that describes a cross-site scripting vulnerability in their DELMIA Service Process Engineer product.

Eaton Advisory - Eaton published an advisory that describes a path traversal vulnerability in their Galileo Software.

Hitachi Advisory - Hitachi published an advisory that discusses three vulnerabilities in multiple Hitachi products.

Janitza Advisory - CERT-VDE published an advisory that describes an improper validation of specified type of input vulnerability in the Janitza UMG 96-PA and UMG 96-PA-MID products.

Mitsubishi Advisory - Mitsubishi published an advisory that describes a cleartext storage of sensitive information vulnerability in their GX Works2 product.

Moxa Advisory #1 - Moxa published an advisory that describes a clickjacking vulnerability in their ioLogik E1200 Series and E 2200 series products.

Moxa Advisory #2 - Moxa published an advisory that describes a password autocompletion vulnerability in their ioLogik E1200 Series and E 2200 series products.

Moxa Advisory #3 - Moxa published an advisory that describes a cleartext transmission of sensitive information vulnerability in their ioLogik E1200 Series and E 2200 series products.

Splunk Advisory #1 - Splunk published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Add-On for Palo Alto Networks.

Splunk Advisory #2 - Splunk published an advisory that discusses three vulnerabilities (one with publicly available exploits) in their SOAR product.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-485 - subscription required.

ICS-CERT Publishes Advisory for Janitza Products

This afternoon the DHS ICS-CERT published an advisory for multiple vulnerabilities in the Janitza UMG power quality measuring products. The vulnerabilities were reported by Mattijs van Ommeren of Applied Risk. Janitza has produced new firmware and documentation to mitigate these vulnerabilities, but there is no indication that van Ommeren has been provided an opportunity to verify the efficacy of the fixes.

The vulnerabilities include:

• Weak password protection, CVE-2015-3972;

• Weak session token generation, CVE-2015-3973;

• Hard coded password, CVE-2015-3968;

• Privilege escalation, CVE-2015-3971;

• Persistent cross site scripting, CVE-2015-3970;

• Cross site forgery, CVE-2015-3967; and

• Information disclosure, CVE-2015-3960.

ICS-CERT reports that a moderately skilled attacker could remotely use a publicly available exploit of these vulnerabilities to adjust system parameters; manipulate measurement values and change the function of the device; and compromise availability, integrity, and confidentiality of the device and dependent systems.

In addition to new firmware, ICS-CERT reports that Janitza has produced a new manual [.PDF download] on how to set up a secure TCP/IP connection on most of the affected devices. In addition to setting up that secure connection the manual also addresses:

• Changing passwords for FTP, homepage and display; and

• Setting internal firewall settings.

This advisory was originally released to the US-CERT Secure Portal on September 22^nd. This is apparently the vulnerability that I reported being on the Secure Portal back on October 5^th.