Review – Public ICS Disclosures – Week of 1-20-24

This week we have 16 vendor disclosures from HP (4), HPE (2), Philips, Splunk (5), TRUMPF (3), and WAGO. We also have a vendor update from HPE. We also have two researcher reports for vulnerabilities in products from Zyxel, and TianoCore.

Advisories

HP Advisory #1 - HP published an advisory that discusses 81 vulnerabilities in their ThinPro products.

HP Advisory #2 - HP published an advisory that discusses three vulnerabilities in multiple HP products.

HP Advisory #3 - HP published an advisory that discusses 26 vulnerabilities in their Device Manager product.

HP Advisory #4 - HP published an advisory that discusses three vulnerabilities in their business notebook PCs and thin client PCs.

HPE Advisory #1 - HPE published an advisory that discusses nine vulnerabilities in their Superdome Flex, Superdome Flex 280 and Compute Scale-up Server 3200 Servers.

HPE Advisory #2 - HPE published an advisory that discusses 23 vulnerabilities in their Unified Mediation Bus (UMB) product.

Philips Advisory - Philips published an advisory that discusses two Citrix NetScaler vulnerabilities.

Splunk Advisory #1 - Splunk published an advisory that describes an improper access control vulnerability in their Enterprise product.

Splunk Advisory #2 - Splunk published an advisory that describes an improper input validation vulnerability in their Enterprise and Cloud Platform products.

Splunk Advisory #3 - Splunk published an advisory that describes an insertion of sensitive information into log files vulnerability in their Enterprise product.

Splunk Advisory #4 - Splunk published an advisory that describes an improper input validation vulnerability in their Enterprise for Windows product.

Splunk Advisory #5 - Splunk published an advisory that discusses multiple vulnerabilities in their Enterprise product.

TRUMPF Advisory #1 - CERT-VDE published an advisory that discusses an integer overflow or wraparound vulnerability in multiple TRUMPF products.

TRUMPF Advisory #2 - CERT-VDE published an advisory that discusses four vulnerabilities in the TRUMPF Oseon and True Tops Fab products.

TRUMPF Advisory #3 - CERT-VDE published an advisory that discusses three vulnerabilities in the TRUMPF Oseon product.

WAGO Advisory - CERT-VDE published an advisory that discusses two vulnerabilities in the WAGO e!COCKPIT and WAGO-I/O-Pro products.

Updates

HPE Update - HPE published an update for their OneView advisory that was originally published on January 9^th, 2024.

Researcher Reports

Zyxel Report - SSD Secure Disclosure published a report describing three remote command execution vulnerabilities in earlier versions of the Zyxel VPN firewall.

TianoCore Report - Quarks Lab published a report describing nine vulnerabilities in the TianoCore IPv6 network protocol stack of EDK II.

 

For more details about these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-189 - subscription required.

Review - Public ICS Disclosure – 8-13-21 – Part 1

This week we have two INFRA:HALT disclosures from Pilz and Rockwell  We have seven other vendor disclosures from Aveva, TRUMPF Laser, Moxa, Philips, Pilz, Sick, and SonicWall. We also have an update from VMware. We also have 12 researcher reports affecting products from Siemens and Delta Industrial Automation (10).

 

I will address the Siemens and Schneider advisories and updates in Part 2 tomorrow.

 

INFRA:HALT Advisories

 

Pilz published an advisory discussing the INFRA:HALT vulnerabilities.

Rockwell published an advisory discussing the INFRA:HALT vulnerabilities.

 

Other Advisories

 

Aveva Advisory - Aveva published an advisory describing three vulnerabilities in their SuiteLink Server.

HPE Advisory - HPE published an advisory describing an information disclosure vulnerability in their Edgeline Infrastructure Manager product.

TRUMPF Advisory - CERT-VDE published an advisory discussing eleven vulnerabilities in the TRUMPF TruControl and Peripheral Bus products.

Moxa Advisory - Moxa published an advisory describing a stack-based buffer overflow vulnerability in their EDS-405A Series Ethernet Switches.

Philips Advisory - Philips published an advisory discussing a Windows® print spooler elevation of privilege vulnerability  (CVE-2021-34481).

Sick Advisory - Sick published an advisory discussing the 2017 Windows® SMBv1vulnerability in their MEAC product.

SonicWall Advisory - SonicWall published an advisory describing a remote code execution vulnerability in their Analytics On-Prem product.

VMware Update - VMware published an update for their Workspace ONE Access advisory that was originally published on August 5^th, 2021.

 

Researcher Reports

 

Siemens Report - Adepts of 0xCC published a report describing the development of an exploit for the memory corruption vulnerability (CVE-2020-9273) in ProFTPD 1.3.7

Delta Report - The Zero Day Initiative published tenreports of 0-day vulnerabilities in the Delta DOPSoft product.

 

For more details on these advisories and reports, including links to exploits and third-party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-8-13-21-part - subscription required.