Review – Public ICS Disclosures – Week of 12-17-22

This week we have an OpenSSL 3.0 disclosure from Palo Alto Networks. There are nine vendor disclosures from Dahua, Dell, DIGI, Hikvision, HPE, Microchip, Motorola Solutions, TandD, and Western Digital. Finally, there is a vendor update from Siemens.

OpenSSL. 3.0

Palo Alto Networks published an advisory discussing the OpenSSL 3.0 vulnerabilities.

Vendor Disclosures

Dahua Advisory - Dahua published an advisory that describes twelve vulnerabilities in a variety of Dahua products.

Dell Advisory - Dell published an advisory that describes nine vulnerabilities (includes 3 third-party vulnerabilities) in their Wyse Management Suite. 

DIGI Advisory - DIGI published an advisory that discusses the FragAttack vulnerabilities.

Hikvision Advisory - Hikvision published an advisory that describes an access control vulnerability in their wireless bridge products.

HPE Advisory #1 - HPE published an advisory that directory traversal vulnerability in their OfficeConnect 1820, and 1850 Switch Series.

HPE Advisory #2 - HPE published an advisory that describes a data injection vulnerability in their Superdome Flex and Superdome Flex 280 Servers.

Microchip Advisory - Microchip published an advisory that discusses the Blue's Clues vulnerabilities.

NOTE: Watch Blue’s Clues (sorry, I could not help myself), cute name and everything. It looks like this will be a major issue for Bluetooth enabled devices, particularly medical devices.

Motorola Advisory - Motorola published an advisory discussing the Fortinet buffer overflow vulnerability.

TandD Advisory - TandD published an end of support notice for products operating on Windows 7 and Windows 8 platforms.

Western Digital Advisory - Western Digital published an advisory describing an information disclosure vulnerability in their My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices.

Vendor Updates

Siemens Update - Siemens published an update for their SIPROTEC 5 Devices advisory that was originally published on December 13^th, 2022.

NOTE: NCCIC-ICS has not updated their advisory (ICSA-22-349-14) for the new information.

 

For more details about these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-f5b - subscription required.

Review – Public ICS Disclosure – Week of 8-13-22

This week we have ten vendor disclosures from Aruba Networks, Aveva, Broadcom, Flexera, GE Grid Solutions, QNAP (2), Softing and WAGO (2). There are five vendor updates from B&R, Mitsubishi Electric, Palo Alto Networks, and Schneider (2). We also have a researcher report for products from Boeing. Finally, we have four exploits for products from Palo Alto Networks, FLIR (2), and Advantech.

Aruba Advisory - Aruba published an advisory that describes a sensitive information disclosure vulnerability in their Virtual Internet Access client for Windows.

Aveva Advisory - Aveva published an advisory that describes six vulnerabilities in their Edge product (formerly Indusoft Web Studio).

NOTE: Aveva reports that the vulnerabilities were coordinated through ‘ICS-CERT’ and ZDI, so I expect that there will be a NCCIC-ICS advisory next week.

Broadcom Advisory - Broadcom published an advisory that discusses an OS command injection vulnerability in their SANnav products.

Flexera Advisory - Revenera published an advisory that discusses two vulnerabilities in their FlexNet Publisher.

GE Grid Advisory - GE published an advisory for their Reason S20 product.

QNAP Advisory #1 - QNAP published an advisory that discusses seven vulnerabilities in their NAS products.

QNAP Advisory #2 - QNAP published an advisory that discusses five vulnerabilities in their NAS products.

Softing Advisory - Softing published an advisory that discusses five vulnerabilities in their OPC UA .NET SDK products.

WAGO Advisory #1 - CERT-VDE published an advisory that discusses six vulnerabilities in multiple WAGO product families.

WAGO Advisory #2 - CERT-VDE published an advisory that discusses four vulnerabilities in multiple WAGO product families.

B&R Update - B&R published an update for their Project Upload advisory that was originally published on January 20^th, 2022.

Mitsubishi Update - Mitsubishi published an update for their OpenSSL advisory that was originally published on August 2^nd, 2022.

Palo Alto Networks Update - Palo Alto Networks published an update for their PAN-OS advisory that was originally published on August 10^th, 2022.

Schneider Update #1 - Schneider published an update for their OPC UA advisory that was originally published on July 12^th, 2022 and most recently updated on August, 9^th, 2022.

Schneider Update #2 - Schneider published an update for their APC Smart-UPS advisory that was originally published on March 8^th, 2022 and most recently updated on July 12^th, 2022.

Boeing Report - Pen Test Partners published a report describing two vulnerabilities in the Boeing Onboard Performance Tool (OPT).

Palo Alto Networks Exploit - UnD3sc0n0c1d0 published an exploit for an OS command injection vulnerability in the Palo Alto PAN-OS.

FLIR Exploit #1 - Samy Younsi published an exploit for a remote command execution vulnerability in the FLIR AX8 thermal imaging camera.

FLIR Exploit #2 - Samy Younsi and Thomas Knudsen published an exploit for three vulnerabilities in the FLIR AX8 thermal imaging camera.

Advantech Exploit - Rgod, Shelby Pace, and Y4er published a Metasploit module for a command injection vulnerability in the Advantech iView NetworkServlet.

 

For more details about these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-8-13 - subscription required.

Review – Public ICS Disclosures – Week of 5-7-22 – Part 1

Happy Saturday after 2^nd Tuesday. It is another busy week in ICS disclosures. In Part 1 we have 25 vendor disclosures from Hitachi, Hitachi Energy (2), HP (7), HPE (11), InHand Networks, and Palo Alto Networks (4). There are lots of Intel vulnerabilities lurking here.

Hitachi Advisory - Hitachi published an advisory that discusses 69 vulnerabilities in their Disk Array Systems.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that discusses an off-by-one error vulnerability (with multiple exploits available) in their TXpert Hub CoreTec 4 product.

Hitachi Energy Advisory #2 – Hitachi Energy published an advisory that describes three vulnerabilities in their TXpert Hub CoreTec 4 product.

HP Advisory #1 - HP published an advisory that discusses 28 vulnerabilities in a variety of HP products that utilize the AMD Client UEFI Firmware.

HP Advisory #2 - HP published an advisory that describes a privilege escalation vulnerability in their Jumpstart software in a variety of HP products.

HP Advisory #3 - HP published an advisory that discusses 8 vulnerabilities in a variety of HP products that utilize Intel® Solid State Drive (SSD) or Intel Optane™ SSD products.

HP Advisory #4 - HP published an advisory that discusses a privilege escalation vulnerability in a variety of HP products that utilize Intel® Boot Guard or Intel® Trusted Execution Technology (TXT).

HP Advisory #5 - HP published an advisory that discusses 15 vulnerabilities in a variety of HP products that utilize the Intel 2022.1 IPU BIOS.

HP Advisory #6 - HP published an advisory that describes two vulnerabilities in a variety of HP products that utilize the HP PC BIOS.

HP Advisory #7 - HP published an advisory that describes five vulnerabilities in their UEFI Firmware used in a variety of HP products.

HPE Advisory #1 - HPE published an advisory that describes eleven vulnerabilities in their HPE ProLiant and Apollo Servers.

HPE Advisory #2 - HPE published an advisory that discusses a disclosure of information vulnerability in their ProLiant DL/ML/MicroServer Servers.

HPE Advisory #3 - HPE published an advisory that discusses two vulnerabilities in their PE ProLiant BL/DL/ML/XL and Apollo Servers.

HPE Advisory #4 - HPE published an advisory that discusses a disclosure of information vulnerability in their HPE ProLiant ML/DL/MicroServer Servers.

HPE Advisory #5 - HPE published an advisory that discusses eleven vulnerabilities in their Synergy Servers.

HPE Advisory #6 - HPE published an advisory that discusses an improver validation of array index vulnerability (with publicly available exploit) in their Nimble Storage product.

HPE Advisory #7 - HPE published an advisory that discusses two vulnerabilities in their Synergy Servers.

HPE Advisory #8 - HPE published an advisory that discusses eleven vulnerabilities in their ProLiant DX Servers.

HPE Advisory #9 - HPE published an advisory that discusses two vulnerabilities in their ProLiant DX Servers.

HPE Advisory #10 - HPE published an advisory that discusses two vulnerabilities in various HPE storage products.

HPE Advisory #11 - HPE published an advisory that discusses eleven vulnerabilities in various HPE storage products.

InHand Advisory - InHand published an advisory that describes 17 vulnerabilities in their e Industrial Router IR302.

Palo Alto Advisory #1 - Palo Alto published an advisory that describes an improper neutralization of special elements vulnerability in their PAN-OS.

Palo Alto Advisory #2 - Palo Alto published an advisory that describes an uncontrolled search path element vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #3 - Palo Alto published an advisory that describes a privilege escalation vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #4 - Palo Alto published an advisory that describes an incorrect authorization vulnerability in their Cortex XSOAR.

 

For more details about these disclosures, including links to third-party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5 - subscription required.

Review – Public ICS Disclosures – Week of 3-5-22 – Part 2

For Part 2 we have fourteen more vendor disclosures from HP (2), HPE (4), Medtronic, Palo Alto Networks (2), Philips (2), Softing (2), and Yokogawa. We also have updates from Axis and HPE. There is also an end-of-life notice from Honeywell. Finally, there are also two exploits for products from Siemens and the DirtyPipe vulnerability. Part 3 will be the Siemens and Schneider 2^nd Tuesday advisories and updates not covered by NCCIC-ICS.

HP Advisory #1 - HP published an advisory describing eleven vulnerabilities in the system BIOS of certain HP PC products.

HP Advisory #2 - HP published an advisory describing an out-of-bounds write vulnerability in various HP PC products.

HPE Advisory #1 - HPE published an advisory discussing seven vulnerabilities with multiple public exploits in their HPE Cray System Software.

HPE Advisory #2 - HPE published an advisory discussing two vulnerabilities with multiple publicly available exploits in their HPE B-Series SANnav Management Software.

HPE Advisory #3 - HPE published an advisory discussing the PwnKit vulnerability in their PE Nimble Storage and HPE Alletra 6000 Peer Persistence Witness OVA products.

HPE Advisory #4 - HPE published an advisory discussing the PwnKit vulnerability in their Virtualized Converged NonStop X NS2 VHOST CLIMs.

Medtronic Advisory - Medtronic published an advisory discussing the Access:7 vulnerabilities.

Moxa Advisory - Moxa published an advisory discussing the PwnKit vulnerability.

Palo Alto Advisory #1 - Palo Alto published an advisory describing a use of password has with insufficient computational effort vulnerability in their PAN-OS.

Palo Alto Advisory #2 - Palo Alto published an advisory discussing an out-of-bounds read vulnerability (with a known exploit) in their PAN-OS.

Philips Advisory #1 - Philips published an advisory discussing the Access:7 vulnerabilities.

Philips Advisory #2 - Philips published an advisory discussing the TLStorm vulnerabilities.

Softing Advisory #1 - Softing published an advisory describing an improper input validation vulnerability in their OPC UA C++ SDK products.

Softing Advisory #2 - Softing published an advisory describing an improper input validation vulnerability in their OPC UA C++ SDK products.

Yokogawa Advisory - Yokogawa published an advisory describing three vulnerabilities in their CENTUM VP product. The vulnerabilities were reported by FSTEC of Russia.

Axis Update - Axis published an update for their AXIS IP Utility advisory that was originally published on February 14^th, 2022.

HPE Update - HPE published an update for their HPE SAN Switches advisory that was originally published on July 22^nd, 2021.

Honeywell EOL Notice - Honeywell published an EOL notice for their OmniAssure Touch Readers.

Siemens Exploit - RoseSecurity published an exploit for an unauthenticated Siemens S7-1200 CPU Start/Stop Command.

DirtyPipe Exploit - Max Kellermann  published a Metasploit module for the DirtyPipe vulnerability.

 

For more details about these disclosures, including links to third-party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-3-873 - subscription required.

Review - Public ICS Disclosure – Week of 1-8-22 – Part 1

This week, as we have come to expect for the Saturday after 2^nd Tuesday, we have a full slate of ICS disclosures, including more Log4Shell disclosures, that will take multiple posts to deal with. In Part 1 we have fourteen vendor disclosures from Belden, Blackberry, Dynalite, Hitachi Energy, HPE, Moxa, Palo Alto Networks (4), QNAP (3), and Yokogawa. There is also an update from HPE. There were also two researcher reports for products from IDEMIA and ODA. Finally, we have an exploit for products from SonicWall.

Part 2 of this post will address the Schneider advisories and updates that were published on Tuesday as well as the Siemens updates that were not addressed by NCCIC-ICS this week.

Belden Advisory - Belden published an advisory describing six vulnerabilities in their Tofino and Eagle products.

BlackBerry Advisory - BlackBerry published an advisory describing an elevation of privilege vulnerability in their QNX Neutrino Kernel.

Dynalite Advisory - Dynalite published an advisory discussing two vulnerabilities in their DDNG-BACnet gateway and in Niagara SOFTJACE products.

Hitachi Energy Advisory - Hitachi Energy published an advisory discussing four vulnerabilities in their e-mesh™ Energy Management System (EMS) Product.

HPE Advisory HPE published an advisory describing a remote access vulnerability in their Ezmeral Data Fabric.

Moxa Advisory - Moxa published an advisory describing four vulnerabilities in their VPort 06EC-2V Series and VPort 461A Series IP Cameras and Video Servers.

Palo Alto Advisory #1 - Palo Alto published an advisory describes an uncontrolled search path element vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #2 - Palo Alto published an advisory describes an untrusted search path element vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #3 - Palo Alto published an advisory describing a link following vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #4 - Palo Alto published an advisory describing a file and directory information exposure vulnerability in their Cortex XDR Agent.

Phoenix Contact Advisory - Phoenix Contact published an advisory discussing the NUCLEUS:13 vulnerabilities in their BLUEMARK X1 / LED / CLED printers.

QNAP Advisory #1 - QNAP published an advisory describing a remote code execution vulnerability in their QTS and QuTS hero products.

QNAP Advisory #2 - QNAP published an advisory describing five separate classic buffer overflow vulnerabilities in their QVR Elite, QVR Pro, and QVR Guard products.

QNAP Advisory #3 - QNAP published an advisor describing two vulnerabilities in their QcalAgent.

Yokogawa Advisor - Yokogawa published an advisory discussing a link following vulnerability in the license function in Yokogawa products.

HPE Update - HPE published an update for their Integrated Lights-out 4 advisory that was originally published  on August 23^rd, 2017.

IDEMIA Report - Positive Technologies published a report of a TLS bypass vulnerability in biometric identification vulnerabilities in products from IDEMIA.

ODA Report - ZDI published a report describing a JPG File Parsing Memory Corruption in the Open Design Alliance (ODA) Drawings Explorer.

SonicWall Exploit - jbaines-r7 published Metasploit module for a command injection vulnerability in the SonicWall SMA 100 Series.

For more details on the above disclosures, including links to 3^rd party advisories and vulnerability exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-1-8 - subscription required.