Review – Public ICS Disclosure – Week of 2-3-24

This week we have 22 vendor disclosures from Badger, B&R Automation (2), FortiGuard (4), GE Vernova, Hitachi (2), HPE, Meinberg, Pilz, SEL, Sharp, VMware, WatchGuard (4), and Western Digital. There is also one update from HP. Finally, we have three exploits for products from Forta, Milesight, and Zyxel.

Advisories

Badger Advisory - Incibe-CERT published an advisory that describes four vulnerabilities in their Monitool product.

B&R Advisory #1 - B&R published an advisory that describes a use of broken or risky cryptographic algorithm in their Runtime FTP server component.

B&R Advisory #2 - B&R published an advisory that describes a cross-site scripting vulnerability in their SDM Web interface.

FortiGuard Advisory #1 - FortiGuard published an advisory that describes an out-of-bounds write vulnerability (listed in CISA’s Known Exploit Exploits Catalog) in their FortiOS.

FortiGuard Advisory #2 - FortiGuard published an advisory that describes a lack of certificate validation vulnerability in their FortiOS.

FortiGuard Advisory #3 - FortiGuard published an advisory that describes a use of externally-controlled format string vulnerability.

FortiGuard Advisory #4 - FortiGuard published an advisory that discusses an uncontrolled resource consumption vulnerability (which is listed in CISA’s KEV) in their FortiOS and FortiProxy products.

GE Advisory - GE published an advisory that discusses a use of externally controlled format string vulnerability in their NetworkST4 and Remote Operations Offering.

Hitachi Advisory #1 - Hitachi published an advisory that discusses ten vulnerabilities in multiple Hitachi products.

Hitachi Advisory #2 - Hitachi published an advisory that discusses two vulnerabilities in their JP1 product.

HPE Advisory - HPE published an advisory that discusses 17 vulnerabilities in their Unified OSS Console Assurance Monitoring (UOCAM).  

Meinberg Advisory - Meinberg published an advisory that discusses 18 vulnerabilities in their LANTIME-Firmware.

Pilz Advisory - Pilz published an advisory that discusses six vulnerabilities.

SEL Advisory - SEL published an update notice for a new version of their SEL-5025 Secure Port Software which fixes two security issues.

Sharp Advisory - Sharp published an advisory that describes a path traversal vulnerability in multiple Sharp public display products.

VMware Advisory - VMware has published an advisory that describes five vulnerabilities in their VMware Aria Operations for Networks product.

WatchGuard Advisory #1 - WatchGuard published an advisory that describes a memory corruption vulnerability in their Endpoint products.

WatchGuard Advisory #2 - WatchGuard published an advisory that describes an out-of-bounds write vulnerability in their Endpoint products.

WatchGuard Advisory #3 - WatchGuard published an advisory that describes an arbitrary kernel read vulnerability in their Endpoint products.

WatchGuard Advisory #4 - WatchGuard published an advisory that discusses four Ivanti vulnerabilities.

Western Digital Advisory - Western Digital published an advisory that describes two vulnerabilities in their My Cloud, WD Cloud, and SanDisk ibi products.

Updates

HP Update - HP published an update for their UC Software advisory that was originally published on January 9^th, 2024.

Exploits

Forta Exploit - James Horseman published an Metasploit module for a forced browsing vulnerability in the Forta GoAnywhere MFT.

Zyxel Exploit - Marco Ivaldi published an exploit for an improper input validation vulnerability in multiple Zyxel products.

 

For more information on these disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-2-3 - subscription required.

Review – Public ICS Disclosures – Week of 1-27-24 – Part 2

For Part 2 we have ten additional vendor disclosures from Schneider, SE-elektronic, Sharp, Sick, Splunk (3), Synology, Trumpf, and Zyxel. We also have five researcher reports for vulnerabilities in products from TELSAT (4) and NAVBLUE. Finally, we have six exploits for products from Electrolink.

Advisory

Schneider Advisory - Schneider published an advisory that discusses the recent cyberattack on their Sustainability Business Division.

SE-elektronic Advisory - Incibe-CERT published an advisory that describes two vulnerabilities in the SE-elektronic E-DDC3.3 automation station.

Sharp Advisory - JP-CERT published an advisory that describes seven vulnerabilities in the Sharp Energy Management Controller with Cloud Services product.

Sick Advisory - Sick published an advisory that discuss a deserialization of untrusted data vulnerability that is listed in CISA’s Known Exploited Vulnerability (KEV) catalog.

Splunk Advisory #1 - Splunk published an advisory that describes an insertion of sensitive information in log files vulnerabilities in their Splunk Add-on Builder product.

Splunk Advisory #2 - Splunk published an advisory that describes an insertion of sensitive information in log files vulnerabilities in the Splunk Add-on Builder product.

Splunk Advisory #3 - Splunk published an advisory that discusses two vulnerabilities in the Splunk Add-on Builder.

Synology Advisory - Synology published an advisory that describes an open redirect vulnerability in their DiskStation Manager (DSM) product.

Trumpf Advisory - CERT-VDE published an advisory that discusses four classic buffer overflow vulnerabilities in the Trumpf Oseon and TruTops Fab products.

Zyxel Advisory - Zyxel published an advisory that describes an OS command injection vulnerability in their NAS products.

Researcher Reports

TELSAT Reports - Zero Science published four reports about individual vulnerabilities in the TELSAT marKoni FM Transmitter.

NAVBLUE Report - Pentest Partners published a report describing the lack of an active application transport security (ATS) control in the NAVBLUE Flysmart+ Manager electronic flight bag.

Exploits

Electrolink Exploit #1 - Liquid Worm published an exploit for a credential exposure vulnerability in the Electrolink FM/DAB/TV Transmitter.

Electrolink Exploit #2 - Liquid Worm published an exploit for a credential exposure vulnerability in the Electrolink FM/DAB/TV Transmitter.

Electrolink Exploit #3 - Liquid Worm published an exploit for an authentication bypass vulnerability in the Electrolink FM/DAB/TV Transmitter.

Electrolink Exploit #4 - Liquid Worm published an exploit for a remote authentication vulnerability in the Electrolink FM/DAB/TV Transmitter.

Electrolink Exploit #5 - Liquid Worm published an exploit for a remote denial-of-service vulnerability in the Electrolink FM/DAB/TV Transmitter.

Electrolink Exploit #6 - Liquid Worm published an exploit for a MPFS image remote code execution vulnerability in the Electrolink FM/DAB/TV Transmitter.

 

For more details about these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-560 - subscription required.