Review – 1 Advisory Published – 9-3-24

Today, CISA’s NCCIC-ICS published a control system security advisory for products from LOYTEC.

Advisories

LOYTEC Advisory - This advisory describes ten vulnerabilities (with publicly available exploits) in the Loytec building automation products.

 

For more information on the advisory, including links to researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-published-9-3-24 - subscription required.

Review – Public ICS Disclosures – Week of 11-25-23

This week we have 15 vendor disclosures from Festo, Hitachi Energy (3), HPE, Medtronic, Red Lion, Ruckus, SEL, Sierra Wireless, Synology (2), WatchGuard, and Zyxel (2). There are nine vendor updates from Hitachi Energy (7), HPE, and VMware. There is also a researcher report describing vulnerabilities in products from SEL. Finally, we have two exploits for products from Loytec.

Advisories

Festo Advisory - CERT-VDE published an advisory that discusses an out-of-bounds write vulnerability in multiple Festo products.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that describes three vulnerabilities in their RTU500 series products.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that discusses an off-by-one error vulnerability in their SDM600 series products.

Hitachi Energy Advisory #3 - Hitachi Energy published an advisory that describes an improper input validation vulnerability in their s Relion® 670/650/SAM600-IO series products.

HPE Advisory - HPE published an advisory that discusses two improper initialization vulnerabilities in their Cray Servers and ProLiant DL/XL Servers.

Medtronic Advisory - Medtronic published an advisory that discusses two vulnerabilities in their Mainspring Data Express, and Vital Sync Virtual Patient Monitoring Platform products.

Red Lion Advisory - Red Lion published an advisory that describes an improper neutralization of special elements vulnerability in their Crimson 3.2 software.

Ruckus Advisory - Ruckus published an advisory that describes a cross-site scripting vulnerability in multiple Ruckus products.

SEL Advisory - SEL published a cybersecurity notice for their Blueframe OS product.

Sierra Wireless Advisory - Sierra Wireless published an advisory that describes eight vulnerabilities in their ALEOS, the operating system used in certain Sierra Wireless AirLink Routers.

Synology Advisory #1 - Synology published an advisory that describes an arbitrary code execution vulnerability in their Synology Camera BC500 and Synology Camera TC500.

Synology Advisory #2 - Synology published an advisory that describes a man-in-the-middle vulnerability in their Router Manager.

WatchGuard Advisory - WatchGuard published an advisory that discusses the heap buffer overflow in libwebp WebP Codec vulnerability that is listed in the CISA Known Exploited Vulnerabilities catalog.

Zyxel Advisory #1 - Zyxel published an advisory that describes nine vulnerabilities in multiple Zyxel firewall and access point (AP) products.

Zyxel Advisory #2 - Zyxel published an advisory that describes the six vulnerabilities in their NAS326 and NAS542 products.

Updates

Hitachi Energy Updates - Hitachi Energy published seven updates for the purpose of rebranding the advisories from “Hitachi/ABB Power Grids” to “Hitachi Energy”.

HPE Update - HPE published an update for their OneView advisory that was originally published on October 25^th, 2023.

VMware Update - VMware published an update for their Cloud Director Appliance advisory that was originally published on November 14^th, 2023.

Researcher Reports

SEL Report - Nozomi Networks published a report describing five vulnerabilities in the SEL-451 substation bay control  device.

Exploits

Loytec Exploit #1 - Chizuru Toyama published an exploit for three vulnerabilities in the Loytec LINX Configurator.

Loytec Exploit #2 - Chizuru Toyama published an exploit for a four vulnerabilities in the Loytec LINX Configurator.

 

For more details about these disclosures, including links to researcher reports, 3^rd party advisories, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-7e2 - subscription required.

ICS-CERT Updates an Advisory and Publishes Another

Today the DHS ICS-CERT updated a previously published advisory for a product from Siemens. They also published a new advisory for a product from LOYTEC.

Siemens Update

This update provides additional information on an advisory that was originally published on originally published on May 9^th, 2017 and updated on June 15, 2017, on July 25^th, 2017, and then again on August 18^th, 2017. The update provides new affected version information and mitigation links for:

• SCALANCE M-800,S615: All versions prior to V04.03,

LOYTEC Advisory

The advisory describes four vulnerabilities in the LOYTEC LVIS-3ME HMI touch panel. The vulnerabilities were reported by Davy Douhine of RandoriSec. LOYTEC has released a firmware update to mitigate the vulnerabilities. There is no indication that Douhine was provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Relative path traversal - CVE-2017-13996;

• Insufficient entropy - CVE-2017-13992;

• Improper neutralization of input during web page generation - CVE-2017-13994; and

• Insufficiently protected credentials - CVE-2017-13998

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to cause information exposure or allow arbitrary code execution.

ICS-CERT Updates Rockwell Advisory and Publishes 3 New Advisories

Today the DHS ICS-CERT updated an earlier control system advisory for a series of Rockwell controllers. It also published new control system advisories from Pacom, LOYTEC, and XZEARES.

ICS-CERT announced earlier today on TWITTER that the ICSJWG 2016 Spring Meeting will occur May 3-5, 2016, in Scottsdale, AZ. More information will become available on the Industrial Control Systems Joint Working Group (ICSJWG) web site as the meeting date gets closer.

Rockwell Update

This update provides additional information on an advisory published this October. Rockwell is reporting that the previously uncorrected vulnerability in the MicroLogic 1400 controller has been corrected in a new firmware version.

NOTE: This update is not listed on the ICS-CERT landing page. To learn of these updates in near real-time you need to follow ICS-CERT on Twitter (@ICSCERT).

Pacom Advisory

This advisory describes an inadequate cryptography vulnerability in the Pacom GMS system. The vulnerability was originally reported by the Swedish companies XPD and Assured. Pacom has not updated the GMS, but ICS-CERT reports that they have “fixed the new EMCS system”. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to take control over the communication between the controller and base station.

This advisory was originally released to the US-CERT Secure Portal on November 3^rd, 2015. Instructions for critical infrastructure owners and security researchers to gain access to that Secure Portal can be found at the bottom of the ICS-CERT landing page.

LOYTEC Advisory

This advisory describes a password file vulnerability in the LOYTEC LIP-3ECTB routers. The vulnerability was originally reported by Maxim Rupp. LOYTEC has produced a firmware update to mitigate this vulnerability but there is no indication that Maxim Rupp was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to gain access to the network.

XZERES Advisory

This advisory describes a cross-site scripting vulnerability in the XZERES 442SR wind turbine generator operating system (OS). The vulnerability was reported by Karn Ganeshen. XZERES had produced a patch to mitigate the vulnerability, but there is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker could adapt code available on-line to remotely exploit this vulnerability to gain admin rights to the system.