Review – Public ICS Disclosures – Week of 2-21-25 – Part 2

For Part 2 we have five additional vendor disclosures from Planex Communications, SEL (2), Sick, and Sierra Wireless. There are also eight vendor updates from Broadcom (4), Dell, Hitachi Energy, HPE, and Sick. There is a researcher report for vulnerabilities in products from Siemens. Finally, we have an exploit for products from FortiGuard.

Advisories

Planex Advisory - JP-CERT published an advisory that describes two vulnerabilities in the Planex Wireless LAN routers.

SEL Advisory #1 - SEL published a software update notice that included cybersecurity enhancements to fix six third-party vulnerabilities (one with publicly available exploit) for their SEL-3350 product.

SEL Advisory #2 - SEL published a software update notice that included cybersecurity enhancements to fix three third-party vulnerabilities for their SEL-3355-2 and SEL-3360-2 products.

Sick Advisory - Sick published an advisory that describes two vulnerabilities in their Lector8xx and InspectorP8xx products.

Sierra Wireless Advisory - Semtech published an advisory that discusses the 5Ghoul vulnerabilities in their s EM919x and EM929x cellular modules.

Updates

Broadcom Update #1 - Broadcom published an update for their Brocade Fabric OS advisory that was originally published on September 26^th, 2024, and most recently updated on January 7^th, 2025.

Broadcom Update #2 - Broadcom published an update for their Brocade SANnav advisory that was originally published on October 14^th, 2024, and most recently updated on February 13^th, 2024.

Broadcom Update #3 - Broadcom published an update for their Brocade ASCG advisory that was originally published on January 7^th, 2025, and most recently updated on February 13^th, 2025.

Broadcom Update #4 - Broadcom published an update for their compromised container advisory that was originally published on October 14^th, 2024.

Dell Update - Dell published an update for their ThinOS advisory that was originally published on September 9^th, 2024.

Hitachi Energy Update - Hitachi Energy published an update for their Relion 670/650/SAM600-IO series advisory that was originally published on November 4^th, 2021, and most recently updated on March 14^th, 2023.

HPE Update - HPE published an update for their ProLiant DL/ML advisory that was originally published on February 11^th, 2025.

Sick Update - Sick published an update for their MEAC300 advisory that was originally published on February 14^th, 2025.

Researcher Reports

Siemens Report - SEC Consult published a report describing two vulnerabilities in the Siemens A8000 CP-8050 and CP-8031 PLCs.

Exploits

FortiGuard Exploit - Indoushka published an exploit for a code execution vulnerability in the FortiGuard FortiManager product.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-ef6 - subscription required.

Review – Public ICS Disclosures – Week of 2-17-24

This week we have 13 vendor disclosures from ADT-TEC Industrial IT, B&R, Elecom (2), Hitachi, HP, HPE, Palo Alto Networks, Sierra Wireless, VMware (2), WAGO, and Zyxel. There are two vendor updates from Cisco and Elecom. There are also 14 researcher reports for products from Imaging Data Commons, Inductive Automation, Sante, SourceForge (8), Weston (3). Finally, we have three exploits for products from Mayurik (2) and QNAP.

Advisories

ADS-TEC Advisory - CERT-VDE published an advisory that discusses an exposure of resource to wrong sphere vulnerability in multiple ADS-TEC DVG-IRF industrial routers.

B&R Advisory - B&R published an advisory that describes an insufficient communication encryption vulnerability in their Automation Studio and Technology Guarding products.

Elecom Advisory #1 - JP CERT published an advisory that describes two vulnerabilities in the Elecom wireless LAN routers.

Elecom Advisory #2 - JP CERT published an advisory that describes an OS command injection vulnerability in the Elecom wireless LAN routers.

Hitachi Advisory - Hitachi published an advisory that describes an EL injection vulnerability in their Global Link Manager.

HP Advisory - HP published an advisory that discusses a service location protocol vulnerability (listed in CISA’s Known Exploited Vulnerability (KEV) Catalog) in their Tera2 Zero Client and Remote Workstation Card.

HPE Advisory - HPE published an advisory that discusses the generation of error message containing sensitive information vulnerability in their IceWall products.

Palo Alto Networks Advisory - Palo Alto Networks published an advisory that discusses the Leaky-Vessels vulnerabilities.

Sierra Wireless Advisory - Sierra Wireless published an advisory that discusses three vulnerabilities in their s EM919x and EM929x

cellular modules.

VMware Advisory #1 - VMware published an advisory that describes a privilege escalation vulnerability in their Aria Operations product.

VMware Advisory #2 - VMware published an advisory that describes two vulnerabilities in their deprecated VMware Enhanced Authentication Plug-in.

WAGO Advisory - CERT-VDE published an advisory that discusses the Terrapin-Attack vulnerability.

Zyxel published an advisory that describes four vulnerabilities in their firewall and AP products.

Zyxel Advisory - Zyxel published an advisory that describes four vulnerabilities in their firewall and AP products.

Updates

Cisco Update - Cisco published an update for their cURL and libcurl vulnerability advisory that was originally published on October 11^th, 2023 and most recently updated on November 8^th, 2023.

Elecom Update - JP-CERT published an update for their ELECOM and LOGITEC network devices advisory that was originally published on October 5^th, 2020 and most recently updated on January 23^rd, 2024.

Researcher Reports

Imaging Data Commons Report - Cisco Talos published a report describing two use-after-free vulnerabilities in the Imaging Data Commons libdicom.

Inductive Automation Report - The Zero Day Initiative published two reports for individual vulnerabilities in the Inductive Automation Ignition product.

Sante Report - ZDI published a report describing an improper input validation vulnerability in the Sante PACS Server.

SourceForge Reports - Cisco Talos published eight reports describing individual vulnerabilities in the SourceForge Biosig Project.

Weston Reports - Cisco Talos published three reports describing four vulnerabilities in the Weston Embedded product.

Exploits

Mayurik Exploit #1 - Nu11secur1ty published an exploit for an SQL injection vulnerability in the Mayurik Best Petrol Pump Management Software.

Mayurik Exploit #2 - SoSPiro published an exploit for a remote shell upload vulnerability in the Mayurik Best Petrol Pump Management Software.

QNAP Exploit - Spencer McIntyre published a Metasploit module for an OS command injection vulnerability in the QNAP QTS and QuTS hero products.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-1cf - subscription required.

Review – Public ICS Disclosures – Week of 12-9-23 – Part 2

For Part 2 we have nine additional vendor disclosures for products from Phoenix Contact (6), Schneider (2), and VMware. There are 18 vendor updates from Mitsubishi, Schneider, Siemens (15), and Sierra Wireless. We also have seven researcher reports for vulnerabilities in products from EisBaer, Finally, we have two exploits for products from Atos and Splunk.

Advisories

Phoenix Contact Advisory #1 - Phoenix Contact published an advisory that describes an incorrect permissions assignment for a critical resource vulnerability in their MULTIPROG Engineering tool and ProConOS eCLR SDK.

Phoenix Contact Advisory #2 - Phoenix Contact published an advisory that describes an incorrect permissions assignment for a critical resource vulnerability in their Automation Worx Software Suite and classic line industrial controllers.

Phoenix Contact Advisory #3 - Phoenix Contact published an advisory that describes an incorrect permissions assignment for a critical resource vulnerability in their PLCnext Control.

Phoenix Contact Advisory #4 - Phoenix Contact published an advisory that describes a download of code without integrity check vulnerability in their MULTIPROG Engineering tool and ProConOS eCLR SDK.

Phoenix Contact Advisory #5 - Phoenix Contact published an advisory that describes a download of code without integrity check vulnerability in their Automation Worx Software Suite and classic line industrial controllers.

Phoenix Contact Advisory #6 - Phoenix Contact published an advisory that describes a download of code without integrity check vulnerability in their PLCnext Control.

Schneider Advisory #1 - Schneider published an advisory that discusses a missing authorization vulnerability (that is listed in CISA’s Known Exploited Vulnerabilities Catalog) in their Plant iT/Brewmaxx product.

Schneider Advisory #2 - Schneider published an advisory that describes two vulnerabilities in their Trio License-Free Radio products.

VMware Advisory - VMware published an advisory that describes a privilege escalation vulnerability in their Workspace ONE Launcher.

Updates

Mitsubishi Update - Mitsubishi published an update for their FA Engineering Software advisory that was originally published on November 24^th, 2022 and most recently updated on June 29^th, 2023.

Schneider Update - Schneider published an update for their PowerLogic advisory that was originally published on November 14^th, 2023.

Siemens Update #1 - Siemens published an update for their TIA Portal advisory that was originally published on June 13^th, 2023.

Siemens Update #2 - Siemens published an update for their LOGO! Soft Comfort advisory that was originally published on April 13^th, 2023.

Siemens Update #3 - Siemens published an update for their LOGO! 8 BM Devices advisory that was originally published on October 11^th, 2023.

Siemens Update #4 - Siemens published an update for their SIMATIC S7-1500 TM MFP V1.0 advisory that was originally published on June 13^th, 2023 and most recently updated on November 14^th, 2023.

Siemens Update #5 - Siemens published an update for their SIMATIC S7-1500 TM MFP V1.0 advisory that was originally published on June 13^th, 2023 and most recently updated on November 14^th, 2023.

Siemens Update #6 - Siemens published an update for their LOGO! 8 BM advisory that was originally published on March 9^th, 2021.

Siemens Update #7 - Siemens published an update for their OPC UA Implementations of SIMATIC Products advisory that was originally published on September 12^th, 2023 and most recently updated on October 10^th, 2023.

Siemens Update #8 - Siemens published an update for their n SCALANCE XB-200 advisory that was originally published on November 14^th, 2023.

Siemens Update #9 - Siemens published an update for their Boot Loader of RUGGEDCOM ROS Devices advisory that was originally published on December 10^th, 2019 and most recently updated on September 13^th, 2022.

Siemens Update #10 - Siemens published an update for their S7-1500 CPU devices advisory that was originally published on January 10^th, 2023 and most recently updated on March 14^th, 2023.

Siemens Update #11 - Siemens published an update for their GNU/Linux subsystem of the SIMATIC S7-1500 advisory that was originally published on November 27^th, 2018, and most recently updated on November 14^th, 2023.

Siemens Update #12 - Siemens published an update for their OpenSSL X.400 Address Processing in SIMATIC Products advisory that was originally published on August 8^th, 2023 and most recently updated on September 12^th, 2023.

Siemens Update #13 - Siemens published an update for their OpenSSL RSA Decryption in SIMATIC Products that was originally published on August 8^th, 2023 and most recently updated on November 14^th, 2023.

Siemens Update #14 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on March 8^th, 2022 and most recently updated on April 11^th, 2023.

Siemens Update #15 - Siemens published an update for their WIBU Vulnerability in Industrial Products advisory that was originally published on September 12^th, 2023 and most recently updated on October 10^th, 2023.

Sierra Wireless Update - Sierra Wireless published an update to their ALEOS Security Advisory that was originally published on November 28^th, 2023 and most recently updated on December 7^th, 2023.

Researcher Reports

EisBaer Researcher Report - Claroty Team88 published seven reports on individual vulnerabilities in the EisBaer Scada.

Exploits

Atos Exploit - Armin Weihbold published an exploit for an argument injection vulnerability in the Atos Unify OpenScape Session Border Controller.

Splunk Exploit - Valentin Lobstein published a Metasploit module for an XML injection vulnerability in the Splunk Enterprise product.

 

For more details about these disclosures, including a brief description of changes made in updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-12-5a1 - subscription required. 

Review – 5 Advisories Published – 12-7-23

Today, CISA’s NCCIC-ICS published five control system security advisories for products from Sierra Wireless, ControlByWeb, Johnson Controls, Schweitzer Engineering Laboratories, and Mitsubishi Electric.

Advisories

Sierra Wireless Advisory - This advisory describes seven vulnerabilities in the Sierra Wireless AirLink router with ALEOS firmware.

ControlByWeb Advisory - This advisory describes a cross-site scripting vulnerability in the ControlByWeb Relay.

Johnson Controls Advisory - This advisory describes an uncontrolled resource consumption vulnerability in the Johnson Controls Metasys and Facility Explorer products.

SEL Advisory - This advisory describes an improper restriction of rendered UI layers or frames in the SEL-411L product line.

Mitsubishi Advisory - This advisory discusses two vulnerabilities in the Mitsubishi MELIPC , MELSEC iQ-R, and MELSEC Q Series products.

 

For more details about these advisories, including links to 3^rd party advisories and a down-the-rabbit-hole look at additional potential Sierra Wireless vulnerabilities, see my article at CFSN Detailed Analysis - - subscription required.

Review – Public ICS Disclosures – Week of 11-25-23

This week we have 15 vendor disclosures from Festo, Hitachi Energy (3), HPE, Medtronic, Red Lion, Ruckus, SEL, Sierra Wireless, Synology (2), WatchGuard, and Zyxel (2). There are nine vendor updates from Hitachi Energy (7), HPE, and VMware. There is also a researcher report describing vulnerabilities in products from SEL. Finally, we have two exploits for products from Loytec.

Advisories

Festo Advisory - CERT-VDE published an advisory that discusses an out-of-bounds write vulnerability in multiple Festo products.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that describes three vulnerabilities in their RTU500 series products.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that discusses an off-by-one error vulnerability in their SDM600 series products.

Hitachi Energy Advisory #3 - Hitachi Energy published an advisory that describes an improper input validation vulnerability in their s Relion® 670/650/SAM600-IO series products.

HPE Advisory - HPE published an advisory that discusses two improper initialization vulnerabilities in their Cray Servers and ProLiant DL/XL Servers.

Medtronic Advisory - Medtronic published an advisory that discusses two vulnerabilities in their Mainspring Data Express, and Vital Sync Virtual Patient Monitoring Platform products.

Red Lion Advisory - Red Lion published an advisory that describes an improper neutralization of special elements vulnerability in their Crimson 3.2 software.

Ruckus Advisory - Ruckus published an advisory that describes a cross-site scripting vulnerability in multiple Ruckus products.

SEL Advisory - SEL published a cybersecurity notice for their Blueframe OS product.

Sierra Wireless Advisory - Sierra Wireless published an advisory that describes eight vulnerabilities in their ALEOS, the operating system used in certain Sierra Wireless AirLink Routers.

Synology Advisory #1 - Synology published an advisory that describes an arbitrary code execution vulnerability in their Synology Camera BC500 and Synology Camera TC500.

Synology Advisory #2 - Synology published an advisory that describes a man-in-the-middle vulnerability in their Router Manager.

WatchGuard Advisory - WatchGuard published an advisory that discusses the heap buffer overflow in libwebp WebP Codec vulnerability that is listed in the CISA Known Exploited Vulnerabilities catalog.

Zyxel Advisory #1 - Zyxel published an advisory that describes nine vulnerabilities in multiple Zyxel firewall and access point (AP) products.

Zyxel Advisory #2 - Zyxel published an advisory that describes the six vulnerabilities in their NAS326 and NAS542 products.

Updates

Hitachi Energy Updates - Hitachi Energy published seven updates for the purpose of rebranding the advisories from “Hitachi/ABB Power Grids” to “Hitachi Energy”.

HPE Update - HPE published an update for their OneView advisory that was originally published on October 25^th, 2023.

VMware Update - VMware published an update for their Cloud Director Appliance advisory that was originally published on November 14^th, 2023.

Researcher Reports

SEL Report - Nozomi Networks published a report describing five vulnerabilities in the SEL-451 substation bay control  device.

Exploits

Loytec Exploit #1 - Chizuru Toyama published an exploit for three vulnerabilities in the Loytec LINX Configurator.

Loytec Exploit #2 - Chizuru Toyama published an exploit for a four vulnerabilities in the Loytec LINX Configurator.

 

For more details about these disclosures, including links to researcher reports, 3^rd party advisories, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-7e2 - subscription required.

Review – Public ICS Disclosures – Week of 8-5-23 – Part 1

This week we have 24 vendor disclosures from ABB, AUMA (2), Belden, Broadcom (3), Fujitsu, HP (6), HPE (2), Phoenix Contact (3), Rockwell, Sierra Wireless, Texas Instruments (2), Western Digital, and Zyxel.

Advisories

ABB Advisory - ABB published an advisory that describes two vulnerabilities in their Freelance AC 900F and AC 700F products.

AUMA Advisory #1 - CERT-VDE published an advisory that discusses a cross-site scripting vulnerability in their Master Station product.

AUMA Advisory #2 - CERT-VDE published an advisory that discusses an out-of-bounds write vulnerability in their Master Station product.

Belden Advisory - Belden published an advisory that discusses an out-of-bounds write vulnerability in their Hirschmann Owl product.

Broadcom Advisory #1 - Broadcom published an advisory that discusses a cleartext transmission of sensitive information vulnerability in their Brocade Fabric OS.

Broadcom Advisory #2 - Broadcom published an advisory that discusses a use after free vulnerability in their Brocade Fabric OS.

Broadcom Advisory #3 - Broadcom published an advisory that discusses an uncontrolled recursion vulnerability in their Brocade Fabric OS.

Fujitsu Advisory - Fujitsu published an advisory that discusses eleven vulnerabilities in multiple products.

HP Advisory #1 - HP published an advisory that discusses three vulnerabilities in multiple products.

HP Advisory #2 - HP published an advisory that discusses five vulnerabilities in multiple products.

HP Advisory #3 - HP published an advisory that discusses an insufficient input validation vulnerability in multiple HP products.

HP Advisory #4 - HP published an advisory that discusses a privilege escalation vulnerability in multiple HP products.

HP Advisory #5 - HP published an advisory that discusses a privilege escalation vulnerability in multiple HP products.

HP Advisory #6 - HP published an advisory that discusses six vulnerabilities in multiple HP products.

HPE Advisory #1 - HPE published an advisory that discusses the Inception vulnerability in their ProLiant AMD Servers.

HPE Advisory #2 - HPE published an advisory that discusses the Inception vulnerability in their ProLiant AMD Servers.

Phoenix Contact Advisory #1 - Phoenix Contact published an advisory that discusses eleven vulnerabilities in their PLCnext Engineer.

Phoenix Contact Advisory #2 - Phoenix Contact published an advisory that describes two vulnerabilities in their TC ROUTER and TC CLOUD CLIENT products.

Phoenix Contact Advisory #3 - Phoenix Contact published an advisory that describes 14 vulnerabilities in their WP 6xxx Web panels.

Rockwell Advisory - Rockwell published an advisory that described an incorrect calculation vulnerability in their Armor PowerFlex product.

Sierra Wireless Advisory - Sierra Wireless published an advisory that talks about recent cyberattacks on their AirLink Connection Manager products.

Texas Instruments Advisory #1 - Texas Instruments published an advisory that describes a PN reuse vulnerability in their WL18xx products.

Texas Instruments Advisory #2 - Texas Instruments published an advisory that describes an integer overflow vulnerability in their SimpleLink™ CC32XX SDK.

Western Digital Advisory - Western Digital published an advisory that describes 17 vulnerabilities in their My Cloud Home, My Cloud Home Duo and SanDisk ibi products.

Zyxel Advisory - Zyxel published an advisory that talks about a command injection vulnerability in their P660HN-T1A DSL CPE product (this product is end-of-life) which was originally corrected in 2017.

 

For more of the details about these advisories, including links to 3^rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-258 - subscription required.

Review – Public ICS Disclosures – Week of 7-15-22

This week we have nine vendor disclosures from Aqua eSolutions, Beldon, HP (2), SEL (2), Sierra Wireless, Splunk, and Zyxel. There are two vendor updates from AMI and HPE. We also have three researcher reports about vulnerabilities in products from Tesla. Finally, we have two exploits for products from ABB and Hikvision.

Advisories

Aqua Advisory - Incibe CERT published an advisory that describes a relative path traversal vulnerability in their Aqua Drive.

Belden Advisory - Beldon published an advisory that discusses an undescribed JavaSE vulnerability in several of their Belden and Hirschmann products.

HP Advisory #1 - HP published an advisory that discusses two vulnerabilities in their Security Manager and Web Jetadmin products.

HP Advisory #2 - HP published an advisory that describes an elevation of privilege vulnerability in their LaserJet Pro print products.

SEL Advisory #1 - SEL published a new version notice for their SEL-5030 acSELerator QuickSet software that addresses seven briefly described cybersecurity issues.

SEL Advisory #2 - SEL published a new version notice for their SEL-5036 acSELerator Bay Screen Builder Software that addresses a software validation issue.

Sierra Wireless Advisory - Sierra Wireless published an advisory that briefly discusses a Cl0p ransomware attack on a Sierra Wireless corporate server.

Splunk Advisory - Splunk published an advisory that discusses two vulnerabilities in their SOAR product.

Zyxel Advisory - Zyxel published an advisory that describes seven vulnerabilities in their firewall and WLAN controllers.

Updates

AMI Update - AMI published an update for their -MegaRAC SPX advisory that was originally published on July 5^th, 2023.

HPE Update - HPE published an update for their ArubaOS-CX 8000 Series Switches advisory that was originally published on February 2^nd, 2022.

Researcher Reports

Tesla Reports - The Zero Day Initiative published three reports about individual vulnerabilities in the Tesla Model 3 that were discovered as part of a Pwn2Own competition.

Exploits

ABB Exploit - Paul Smith published an exploit for an exposure of sensitive information to an unauthorized actor vulnerability in the ABB FlowX product.

Hikvision Exploit - Thurein Soe published an exploit for a command injection vulnerability in the Hikvision Hybrid SAN Ds-a71024 product.

Commentary

I would like to commend Sierra Wireless on their advisory about the potential consequences of their recent Cl0p ransomware attack. Ransomware attacks are a big problem, but frequently overlooked in attacks on vendors is that information may have been discovered by the attacker that could be used to exploit product vulnerabilities in their customers. Reports like this one provide customers a heads up about potential attacks on their equipment.

 

For more details about these disclosures, including links to researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-7-c81 - subscription required.

Review – Public ICS Disclosures – Week of 6-17-23

This week we have twelve vendor disclosures from FortiGuard (2), GE Gas Power, HP, HPE, Sick, Schweitzer Engineering Labs (2), Sierra Wireless, VMware, Western Digital, and Zyxel. There is also an update from GE Gas Power. We also have three researcher reports for products from Dell and an update of the OT:ICEFALL report. Finally, we have an exploit for the HiSECOS from Belden.

Advisories

FortiGuard Advisory #1 - FortiGuard published an advisory that describes a deserialization of untrusted data vulnerability in their FortiNAC.

FortiGuard Advisory #2 - FortiGuard published an advisory that describes a command injection vulnerability in their FortiNAC product

GE Gas Power Advisory - GE published an advisory that discusses five vulnerabilities in their Proficy Historian product.

HP Advisory - HP published an advisory that discusses a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in their PC products using AMI UEFI Firmware.

HPE Advisory - HPE published an advisory that discusses a remote code execution vulnerability in their IceWall product modules.

Sick Advisory - Sick published an advisory that describes vulnerabilities in their SICK EventCam App.

SEL Advisory #1 - SEL announced that a new version of their SEL-5037 SEL Grid Configurator is available that mitigates undescribed cybersecurity vulnerabilities.

SEL Advisory #2 - SEL announced that a new version of their SEL-5030 acSELerator QuickSet Software is available that mitigates undescribed cybersecurity vulnerabilities.

Sierra Wireless Advisory - Sierra Wireless published an advisory that provides additional guidance on a previously disclosed improper authentication vulnerability for their routers using the AirLink Management Service (ALMS).

VMware Advisory - VMware published an advisory that describes five vulnerabilities in their vCenter Server and Cloud Foundation products.

Western Digital Advisory - Western Digital published an advisory that describes two command injection vulnerabilities in their My Cloud OS 5 Firmware.

Zyxel Advisory - Zyxel published an advisory that describes a command injection vulnerability in the NAS products. This vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog.

Updates

GE Gas Power Update - GE published an update for their Proficy Historian that was originally published on February 3^rd, 2023.

Researcher Reports

Dell Reports - Binarly published three reports describing individual vulnerabilities in the Dell Edge Gateway BIOS.

OT:ICEFALL Report - Forescout published an update of their OT:ICEFALL report.

Exploits

Belden Exploit - Dreizehnutters published an exploit for a privilege escalation vulnerability in Belden’s HiSecOS Web Server.

 

For more details on these disclosures, including links to researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-7c8 - subscription required.

Review – 15 Advisories Published – 5-11-23

VACATION DELAYED

Earlier this week, CISA’s NCCIC-ICS published 15 control system security advisories for products from Rockwell Automation (4), PTC, SDG, BirdDog, Teltonika, Sierra Wireless, and Siemens (6).

Advisories

Rockwell Advisory #1 - This advisory describes an inadequate encryption strength vulnerability in the Rockwell ThinManager, a software management platform.

Rockwell Advisory #2 - This advisory discusses two vulnerabilities in the Rockwell PanelView 800 graphics terminal.

Rockwell Advisory #3 - This advisory describes three incorrect restriction of operations within the bounds of a memory buffer vulnerabilities in the Rockwell Arena Simulation Software.

Rockwell Advisory #4 - This advisory describes an improper access control vulnerability in the Rockwell Kinetix 5500 EtherNet/IP Servo Drive.

PTC Advisory - This advisory describes six vulnerabilities in the PTC Vuforia Studio products.

SDG Advisory - This advisory describes an SQL injection vulnerability in the SDG PnPSCADA products.

BirdDog Advisory - This advisory describes two vulnerabilities in various BirdDog camera and encoder.

Teltonika Advisory - This advisory describes eight vulnerabilities in the Teltonika Remote Management System and RUT model routers.

Sierra Wireless Advisory - This advisory describes two vulnerabilities in the Sierra Wireless AirVantage cloud management platform.

Siemens Advisory #1 - This advisory describes four vulnerabilities in the Siemens SCALANCE LPE9403.

Siemens Advisory #2 - This advisory discusses nine vulnerabilities in the Siemens SINEC NMS.

Siemens Advisory #3 - This advisory describes seven vulnerabilities in the Siemens SIMATIC Cloud Connect 7 product.

Siemens Advisory #4 - This advisory describes two deserialization of untrusted data vulnerabilities in the Siemens Siveillance Video IP video management software.

Siemens Advisory #5 - This advisory discusses the Framing Frames vulnerability in the Siemens SCALANCE W1750D products.

Siemens Advisory #6 - This advisory describes three vulnerabilities in the Siemens Solid Edge SE2023 product.

 

For more details on these advisories, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/15-advisories-published-5-11-23 - subscription required –

Review – Public ICS Disclosures – Week of 1-28-23

This week we have twelve vendor disclosures from BaiCells, B&R, Hitachi, HP, HPE, JTEKT Electronics, Moxa, Pulse Secure (2), QNAP, and VMware (2). There is also a vendor update from VMware. Finally, we have two researcher reports for products from Sierra Wireless and describing vulnerabilities in the Open Charge Point Protocol for electric vehicle charging stations.

Advisories

BaiCells Advisory - BaiCells published an advisory that describes a use of hard-coded credentials vulnerability in their Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices.

B&R Advisory - B&R published an advisory that describes five vulnerabilities in their ARPOL database.

Hitachi Advisory - Hitachi published an advisory that discusses 60 vulnerabilities in their Disk Array Systems.

HP Advisory - HP published an advisory that describes an escalation of privilege vulnerabilities in their Factory Preinstalled Images.

HPE Advisory - HPE published an advisory that discusses a use-after-free vulnerability in their HPE OneView.

JTEKT Advisory - JP CERT published an advisory that describes seven vulnerabilities in the JTEKT Screen Creator Advance product.

Moxa Advisory - Moxa published an advisory that describes six vulnerabilities in their SDS-3008 Series web server.

Pulse Secure Advisory #1 - Pulse Secure published an advisory that discusses four OpenSSL vulnerabilities.

Pulse Secure Advisory #2 - Pulse Secure published an advisory that describes a cross-site request forgery vulnerability in their Pulse Connect Secure.

QNAP Advisory - QNAP published an advisory that describes an SQL injection vulnerability in their QTS or QuTS hero products.

VMware Advisory #1 - VMware published an advisory that describes a cross-site request forgery bypass vulnerability in their vRealize Operations (vROps).

VMware Advisory #2 - VMware published an advisory that describes an arbitrary file deletion vulnerability in their VMware Workstation product. 

Updates

VMware Update - VMware published an update for their vRealize Log Insight advisory that was originally published on January 24^th, 2023.

Researcher Reports

Sierra Wireless Report - Otorio published a report describing two vulnerabilities in the Sierra Wireless AirLink products. The report contains proof-of-concept code.

OCPP Report - SaiFlow published a report describing two vulnerabilities in the WebSocket communications used by the Open Charge Point Protocol (OCPP).

 

For more details about these disclosures, including links to researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-768 - subscription required.

Review – 7 Advisories and 1 Update Published – 1-26-23

Today, CISA’s NCCIC-ICS published seven control system security advisories for products from Landis+Gyr, Rockwell Automation, Mitsubishi Electric, Sierra Wireless, Snap One, Econolite and Delta Electronics. They also published an update for an advisory for products from Mitsubishi.

Advisories

Landis+Gyr Advisory - This advisory describes a reliance on cookies without validation vulnerability in the Landis+Gyr E850 (ZMQ200) precision meter.

Rockwell Advisory - This advisory discusses two vulnerabilities in multiple Rockwell products using the GoAhead web server.

NOTE: These vulnerabilities in the GoAhead web server from EmbedThis were originally reported by CISCO Talos in 2019.

Mitsubishi Advisory - This advisory describes an active debug code vulnerability in the Mitsubishi MELFA SD/SQ series and F-series Robot Controllers.

Sierra Wireless Advisory - This advisory describes two vulnerabilities in the Sierra Wireless AirLink routers.

Snap One Advisory - This advisory describe four vulnerabilities in the Snap One Wattbox WB-300-IP-3, a surge protector.

Econolite Advisory - This advisory describes two vulnerabilities in the Econolite EOS automated traffic control software.

Delta Advisory - This advisory describes a stack-based buffer overflow vulnerability in the Delta Electronics CNCSoft software management platform.

Updates

Mitsubishi Update - This update provides additional information on an advisory that was originally published on January 17^th, 2023.

 

For more details about these advisories, including links to researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-and-1-update-published-c83 - subscription required.

Public ICS Disclosures – Week of 9-12-20

 This week we have four disclosures for CodeMeter vulnerabilities for products from ABB and Rockwell. There are also three vendor disclosures for products from MB Connect Line, Hi-Silicon, and B&R. There are 21 researcher reports for vulnerabilities in products from Fuji Electric (20) and Sierra Wireless.

CodeMeter Advisories

ABB published an advisory for the CodeMeter vulnerabilities in their Automation Builder product. ABB provides generic workarounds while it continues to investigate the vulnerabilities.

ABB published an update for their CodeMeter advisory for ABB Products. The new information includes providing a link to the advisory described above.

ABB published an update for their CodeMeter advisory for ABB Drives applications. The new information includes changing the recommended version of CodeMeter for Windows application to version 7.10a.

Rockwell published an update for their CodeMeter advisory for FactoryTalk Activation Manager. The new information includes:

• Updated mitigation information, and

• Updated CodeMeter version information

MB Advisory

CERT-VDE published an advisory describing four vulnerabilities in the mymbCONNECT24 and mbCONNECT24 products. The vulnerabilities were reported by Otorio. MB has new versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Blind SQL injection - CVE-2020-24569 and CVE-2020-24568,

• SSRF/CSRF - CVE-2020-24570, and

• Unauthenticated RCE – no CVE assigned

HI-Silicon Advisory

Incibe-cert published an advisory describing five vulnerabilities in the IPTV / H.264 / H.265 video encoders based on HiSilicon Hi3520d hardware. The vulnerabilities were reported by Alexei Kojenov; the report contains proof-of-concept code. Affected manufacturers include:

• URayTech;

• J-Tech Digital;

• VeCASTER PRO from Pro Video Instruments.

The five reported vulnerabilities include:

• Backdoor password - CVE-2020-24215 and CVE-2020-24218,

• Path transversal - CVE-2020-24219,

• Unauthenticated file uploads - CVE-2020-24217,

• Buffer overflow - CVE-2020-24214, and

• Unauthorized access to video streaming through RTSP - CVE-2020-24216

B&R Advisory

B&R published an advisory for the Ripple20 vulnerabilities in their products. They report that none of their products are affected by these vulnerabilities.

Fuji Electric Reports

Kimiya published 20 reports (ZDI-20-1184 thru ZDI-20-1204) of vulnerabilities in the Fuji Electric Tellus Lite product. The vulnerabilities were reported to ‘ICS-CERT’ (presumably, NCCIC-ICS) by the Zero Day Initiative back in April. These are apparently separate vulnerabilities from the 14 that were reported last week. The reported vulnerabilities include:

• Stack-based buffer overflow,

• Out-of-bounds write, and

• Out-of-bounds read

Sierra Wireless Report

Ruben Santamarta published a blog post describing two vulnerabilities in Sierra Wireless Air Link Products. Sierra Wireless has published an advisory [.PDF download link] for these vulnerabilities. The blog post includes proof-of-concept code.

The two reported vulnerabilities are:

• Privilege escalation - CVE-2020-8781, and

• Remote code execution - CVE-2020-8782

1 Update Published – 4-23-20

Today the CISA NCCIC-ICS published an up date for a control system security advisory for products from Sierra Wireless. I also take a brief look at CISA cyber issue reporting processes. 

Sierra Wireless Update

This update provides additional information on an advisory that was originally published on May 2^nd, 2019 and most recently updated on August 20, 2019. The new information includes updated version data and mitigation measures for LS300, GX400, GX440, and ES440 products.

Reporting Cyber Issues

Today CISA added a new “Report Cyber Issue” button on the Chemical Facility Anti-Terrorism Standards (CFATS) landing page. That button takes you to the CISA “Report Incidents, Phishing, Malware, or Vulnerabilities” page. This is a nice concise page with reporting criteria and links for reporting a variety of cyber issues. The URL for the page is a “us-cert.gov” URL which probably means that the site has been around for a while. Of course, since this is a CISA web site, there is no date for the last change to the page.

The next to last paragraph has a link that takes you to the “CISA Coordinated Vulnerability Disclosure (CVD) Process” web site. Low and behold, it does have an ‘originally created’ date of December 3^rd, 2019. For IOT, ICS or medical device vulnerability reporting it provides an email address (NCCICCUSTOMERSERVICE@hq.dhs.gov), a link to the CISA ICS public key, and a telephone number (1-888-282-0870). For reporting IT security issues, it provides a link to the Carnegie Mellon University CERT Coordination Center.

1 Advisory, 2 Updates Published – 08-20-19

Today the DHS NCCIC-ICS published a control system security advisory for products from Zebra and two updates for advisories for products from Siemens and Sierra Wireless.

Zebra Advisory

This advisory describes an insufficiently protected credentials vulnerability in the Zebra Industrial Printers. The vulnerability was reported by Tri Quach. Zebra has a new version that mitigates the vulnerability. There is no indication that Tri has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow a remote attacker to send specially crafted packets to a port on the printer, resulting in the retrieval of a front control panel passcode.

Siemens Update

This update provides new information on an advisory that was originally published on August 13th, 2019. NCCIC-ICS changed the vulnerability description from ‘uncontrolled resource consumption’ to ‘insufficient resource pool’. There was no corresponding change in the Siemens advisory; Siemens does not use CWE vulnerability titles or codes in their advisories.

Sierra Wireless Update

This update provides new information on an advisory that was originally published on May 2nd, 2019. The  update reports that the ALEOS 4.12.0 Release Note is now available.

Three Advisories Published – 05-02-19

Yesterday the DHS NCCIC-ICS published three control system security advisories for products from Sierra Wireless, GE, and Orpak

Sierra Wireless Advisory

This advisory describes seven vulnerabilities in the Sierra Wireless AirLink ALEOS. The vulnerabilities were reported by Carl Hurd and Jared Rittle of Cisco Talos. Sierra Wireless reports that the latest version of ALEOS (not all yet available) mitigates the vulnerability. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

The seven reported vulnerabilities are:

• OS command injection - CVE-2018-4061;

• Use of hard-coded credentials - CVE-2018-4062;

• Unrestricted upload of file with dangerous type - CVE-2018-4063

• Cross-site scripting - CVE-2018-4065;

• Cross-site request forgery - CVE-2018-4066;

• Information exposure - CVE-2018-4067; and

• Missing encryption of sensitive data - CVE-2018-4069

The Talos web site lists six additional vulnerabilities (with exploits) {NOTE: the Sierra Wireless advisory (.PDF Download) explains these ‘vulnerabilities’}:

• Information exposure -  CVE-2018-4068;

• Unverified password change - CVE-2018-4064;

• Information disclosure (2) - CVE-2018-4070, CVE-2018-4071; and

• Permission assignment (2) - CVE-2018-4072, CVE-2018-4073

NCCIC-ICS reports that a relatively low-skilled attacker could use publicly available exploits to remotely exploit these vulnerabilities to remotely execute code, discover user credentials, upload files, or discover file paths.

GE Advisory

This advisory describes five vulnerabilities in the General Electric Communicator. Reid Wightman of Dragos. GE has a new version that mitigates the vulnerability. There is no indication that Reid has been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Uncontrolled search path (2) - CVE-2019-6564 and CVE-2019-6546;

• Hard-coded credentials - CVE-2019-6548; and

• Improper access controls (2) - CVE-2019-6544 and CVE-2019-6566

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to gain administrative privileges, manipulate widgets and UI elements, gain control over the database, or execute administrative commands.

Orpak Advisory

This advisory describes six vulnerabilities in the Orpak SiteOmat fuel management software. The vulnerabilities were reported by Ido Naor of Kaspersky Lab. Orpak has an update available that mitigates the vulnerability. This is no indication that Naor has been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Use of hard-coded credentials - CVE-2017-14728;

• Cross-site scripting - CVE-2017-14850;

• SQL injection - CVE-2017-14851;

• Missing encryption of sensitive data - CVE-2017-14852;

• Code injection - CVE-2017-14853; and

• Stack-based buffer overflow - CVE-2017-14854

NCCIC-ICS reports that a relatively low-skilled attacker could use publicly available exploits (NOTE: The exploits have been available for over one year) to remotely exploit these vulnerabilities to effect arbitrary remote code execution resulting in possible denial-of-service conditions and unauthorized access to view and edit monitoring, configuration, and payment information.

DHS Publishes Three Advisories

Today the DHS ICS-CERT published three control system security advisories for products from Hyundai Motor, Sierra Wireless and BLF-Tech.

Hyundai Motor Advisory

This advisory describes two vulnerabilities in the Hyundai Motor Blue Link. The vulnerabilities were reported by Will Hatzer and Arjun Kumar working with Rapid7. Hyundai produced a new version that mitigates the vulnerability. There is no indication that the researchers have been provided the opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Man-in-the-Middle – CVE-2017-6052; and

• Use of Hard-Coded Cryptographic Key – CVE-2017-6054

ICS-CERT reports that an attacker (no characterization of the skill level is provided) could remotely exploit this vulnerability to gain access to insecurely transmitted sensitive information, which could allow the attacker to locate, unlock, and start a vehicle associated with the affected application.

NOTE: A Rapid7 blog post provides more details about the vulnerability.

Sierra Wireless Advisory

NOTE: This advisory provides additional information on vulnerabilities that were initially reported by ICS-CERT in an Alert last June.

This advisory describes three vulnerabilities in the Sierra Wireless AirLink Raven XE and XT. The vulnerabilities were reported by Karn Ganeshen. Sierra Wireless has produced new firmware that mitigates two of the three reported vulnerabilities. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities were:

• Improper Authorization – CVE-2017-6044;

• Cross-Site Request Forgery – CVE-2017-6042; and

• Insufficiently Protected Credentials (Not mitigated) – CVE-2017-6046

Neither this advisory nor the Sierra Wireless Technical Bulletin [.DOC download] from last summer address the fourth vulnerability reported by Ganeshen in his disclosure; unauthenticated access to directories and arbitrary file upload.

ICS-CERT reports that a relatively unskilled attacker could use the publicly available exploits for these vulnerabilities to remotely attack these devices to perform unauthorized sensitive functions compromising the confidentiality, integrity, and availability of the affected system.

BLF-Tech Advisory

This advisory describes an uncontrolled search path element vulnerability in the BLF-Tech VisualView HMI. The vulnerability was reported by Karn Ganeshen. BLF-Tech has produced a new version to mitigate the vulnerability. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker (access requirements not characterized) could exploit the vulnerability to to execute arbitrary code within the system.

ICS-CERT Publishes Sierra Wireless Alert

Today the DHS ICS-CERT took the unusual step of issuing a control system security alert for a ‘vulnerability’ being self-reported by the vendor. ICS-CERT reports that Sierra Wireless has issued a technical bulletin [.PDF Download] describing mitigation measures that owners can take to stop the Mirai malware from infecting AirLink gateways that are using the default ACEmanager password and are reachable from the public internet.

ICS-CERT is careful to note “that there is no software or hardware vulnerability being exploited in the Sierra Wireless devices by the Mirai malware”. The problem is in configuration management; using the default password.

It is nice to see that a vendor is taking specific steps to identify problems in configuration management for their products that allow an outside agency to take control of those products to become part of a botnet. And to further share that information with ICS-CERT to help get the word out is something to be commended. It would sure be nice if all vendors were so proactive.

ICS-CERT Publishes Two Advisories and an Alert

This afternoon the DHS ICS-CERT published two new control system security advisories for products from Siemens, Eaton. It also published an alert for a publicly shared vulnerability in a Sierra Wireless product.

Siemens Advisory

This advisory describes two vulnerabilities in the Siemens  SICAM PAS (Power Automation System). The vulnerabilities were reported by Ilya Karpov and Dmitry Sklyarov of Positive Technologies. Siemens has produced a new version and instructions to mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The vulnerabilities are:

• Insufficiently protected credentials - CVE-2016-5848; and

• Information exposure - CVE-2016-5849.

ICS-CERT reports that a relatively unskilled attacker with local access could exploit the vulnerability to obtain sensitive information under certain conditions. The Siemens-CERT advisory reports that the attacker must have local access to the SICAM PAS system and certain database privileges or the database must be in a stopped state.

Siemens reported this vulnerability this morning on TWITTER®.

Eaton Advisory

This advisory describes twin buffer overflow vulnerabilities in the Eaton ELCSoft programming software. The vulnerabilities were reported by Ariele Calgaviano via the Zero Day Initiative (ZDI). Eaton has released a revision to mitigate these vulnerabilities. There is no indication that Eaton has provided Calgaviano an opportunity to verify the efficacy of the fix.

The vulnerabilities are:

• Heap-based buffer overflow - CVE-2016-4509; and

• Stack-based buffer overflow - CVE-2016-4512.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit these vulnerabilities to execute arbitrary code on the target system.

Sierra Wireless Alert

This alert describes three vulnerabilities in the Sierra Wireless AirLink Raven XE and XT gateways. The vulnerabilities were reported in a coordinated disclosure by Karn Ganeshen. Sierra Wireless has reported to ICS-CERT that these devices are end of life and no new firmware releases will be made available. Ganeshen released a public report on four vulnerabilities on the Full Disclosure site on June 22^nd, 2016 after he was advised that no updates were planned by Sierra Wireless.

The four vulnerabilities reported by Ganeshen are:

• Weak credential management (not reported in ICS-CERT Alert);

• Ace Manager contains a global CSRF vulnerability;

• Sensitive information leakage via GET requests; and

• Unauthenticated access to directories + Arbitrary File Upload.

ICS-CERT reports that Sierra Wireless has provided written mitigation measures to reduce these vulnerabilities.

NOTE: ICS-CERT did report the name of the reporting researcher, but did not provide a link to the public report.

Unreported Siemens Update

Siemens reported in another TWEET® this morning that they had updated a Siemens-CERT advisory that was reported by ICS-CERT on May 19^th, 2016. We may see the updated ICS-CERT advisory tomorrow.

ICS-CERT Publishes 3 Advisories

This morning the DHS ICS-CERT published three control system advisories for systems from Ecava, Accuenergy, and Sierra Wireless.

Ecava Advisory

This advisory describes multiple vulnerabilities in the Ecava IntegraXor application. The vulnerabilities were independently reported by Steven Seeley of Source Incite and Marcus Richerson. Ecava has produced a new version to mitigate the vulnerabilities. Richerson has tested the new version and verified that it fixed all but one (partially fixed) of the vulnerabilities; Ecava will address that in their next release.

The eight vulnerabilities include:

• Clear text transmission of sensitive information - CVE-2016-2306;

• Cross-site scripting - CVE-2016-2305;

• Improper neutralization of alternate XSS syntax - CVE-2016-2304;

• Improper authorization - CVE-2016-2300;

• SQL injection (2) - CVE-2016-2299 and CVE-2016-2301;

• Information exposure - CVE-2016-2302; and

• Improper neutralization of CLRF sequences in HTTP headers - CVE-2016-2303

ICS-CERT reports that a relatively unskilled attacker could remotely use publicly available exploits to gain complete control of the system.

The Ecava vulnerability note does not mention that one of the vulnerabilities is only partially corrected. Nor does it mention the role of Steven Seeley.

NOTE: There is a minor error in the ICS-CERT advisory. The print version of the link has an incorrect version number (5.0.4522.2 instead of 5.0.4525.2), but the actual link goes to the correct place.

Accuenergy Advisory

This advisory describes twin vulnerabilities in the Accuenergy Acuvim II Series AXM-NET module. The vulnerabilities were reported by Maxim Rupp. Accuenergy has developed suggested user mitigations and there is no indication that a fix is planned for the vulnerabilities.

The vulnerabilities are:

• Authentication bypass issues - CVE-2016-2293; and

• Plain text storage of passwords - CVE-2016-2294

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to execute a denial of service attack on the meter.

The Accuenergy suggested mitigations are very broadly painted instructions designed to deny unauthorized access to the meter. They include the use of firewalls, authentication, and VPN use. No specific information for the use of these techniques with this equipment is provided.

Sierra Wireless Advisory

This advisory describes a file and directory information exposure vulnerability in the Sierra Wireless ACEmanager application. The vulnerability was reported by Maxim Rupp. Sierra Wireless has produced a new version that mitigates the vulnerability, but there is no indication that Rupp has been provided the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to  learn operational characteristics of the gateway.