Review – Public ICS Disclosure – Week of 7-22-23

This week we have 21 vendor disclosures from ABB (2), Aruba Networking, Belden (3), Bosch, Brocade (2), B&R, CODESYS, Fujitsu (3), Hitachi Energy (2), Honeywell, HPE, QNAP (2), and VMware. There is one researcher report for vulnerabilities in products from Advantech. Finally, we have two exploits for products from Western Digital and VMware.

Advisories

ABB Advisory #1 - ABB published an advisory that describes four vulnerabilities in their Ability™ zenon product.

ABB Advisory #2 - ABB published an advisory that describes an unquoted search path vulnerability in their AO-OPC product.

Aruba Advisory - Aruba published an advisory that describes four vulnerabilities in their Access Points products

Belden Advisory #1 - Belden published an advisory that discusses a NULL pointer dereference vulnerability in their Hirschmann HiSecOS.

Belden Advisory #2 - Belden published an advisory that discusses a cross-site scripting vulnerability in their Eagle firewall products.

Belden Advisory #3 - Belden published an advisory that discusses four vulnerabilities in their Hirschmann HiSecOS.

Bosch Advisory - Bosch published an advisory that discusses 30 vulnerabilities in their PRA-ES8P2S Ethernet-Switchs.

Broadcom Advisory #1 - Broadcom published an advisory that discusses a permission validation vulnerability in the BrocadeOS products.

Broadcom Advisory #2 - Broadcom published an advisory that discusses the MoveIT SQL injection vulnerability, which is on the CISA Known Exploited Vulnerabilities Catalog.

B&R Advisory - B&R published an advisory that describes an allocation of resources without limit or throttling vulnerability in the Portmapper service used in their Automation Runtime product.

CODESYS Advisory - CODESYS published an advisory that describes an exposure of resource to wrong sphere vulnerability in their Scripting addon.

Fujitsu Advisory #1 - Fujitsu published a notice about potential vulnerabilities being investigated based upon third-party advisories from Insyde.

Fujitsu Advisory #2 - JP CERT published an advisory that describes an authentication bypass vulnerability in the Fujitsu Si-R series and SR-M series network devices.

Fujitsu Advisory #3 - JP CERT published an advisory that describes a hard-coded credentials vulnerability in the Fujitsu IP Series Real-time Video Transmission Gear.

Hitachi Energy Advisory #1 - Hitachi published an advisory that discusses six vulnerabilities in their AFF66x Products. These are third-party vulnerabilities.

Hitachi Energy Advisory #2 - Hitachi published an advisory that describes two classic buffer overflow vulnerabilities in their RTU500 series product.

Honeywell Advisory - Honeywell published an end-of-life notice for their MAXPRO® VMS R600 and R630 / NVR6.0 & R6.3 products.

HPE Advisory - HPE published an advisory that describes a privilege escalation vulnerability in their Integrated Smart Update Tools (iSUT) for Windows.

QNAP Advisory #1 - QNAP published an advisory that discusses an OS command injection vulnerability in many of their products.

QNAP Advisory #2 - QNAP published an advisory that describes an insecure library loading vulnerability in their QVPN Device Client for Windows.

VMware Advisory - VMware published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Tanzu Application Service for VMs.

Reports

Advantech Report - Tenable published a report that describes an SQL injection vulnerability in the Advantech iView.

Exploits

Western Digital Exploit - Remco Vermeulen published a Metasploit module for two vulnerabilities in the Western Digital MyCloud product.

VMware Exploit - H00die published a Metasploit module for a command injection vulnerability in the VMware Aria Operations for Networks product.

Review – Public ICS Disclosures – Week of 1-21-23

This week we have an OpenSSL 3.0 advisory from Dell. We have seven vendor disclosures from Carrier, Contec, GE Grid Solutions, Meinberg, Omron, and PulseSecure (2). We also have three vendor updates from CODESYS, HPE, and PcVue. Finally, we have 16 researcher reports for products from Siretta (14), Zyxel, and Delta Electronics.

Open SSL 3.0 Advisories

Dell published an advisory that discusses the OpenSSL 3.0 vulnerabilities.

Vendor Advisories

Carrier Advisory - Carrier published an advisory that discusses multiple authentication bypass vulnerabilities in their WebCTRL® and i-Vu® software.

Contec Advisory - Contec published an advisory that describes an SQL injection vulnerability in the Contec CONPROSYS HMI System.

GE Grid Solutions Advisory - GE Grid Solutions published an advisory for their DS Agile Distributed Control System.

Meinberg Advisory - Meinberg published an advisory that discusses eight vulnerabilities in their LANTIME product.

Omron Advisory - JP Cert published an advisory that describes an improper restriction of an XML entity reference vulnerability in the OMRON CX-Motion Pr.

PulseSecure Advisory #1 - PulseSecure published an advisory that discusses a use-after-free vulnerability.

PulseSecure Advisory #2 - PulseSecure published an advisory that discusses a double free vulnerability.

Vendor Updates

CODESYS Update - CODESYS published an update for their Control V3 communication server advisory that was originally published on November 22nd, 2022 and most recently updated on December 14^th, 2022.

HPE Update - HPE published an update for their IceWall advisory that was originally published on March 9^th, 2018 and most recently updated on May 26^th, 2021.

PcVue Update - PcVue published an update for their email and SMS accounts advisory that was originally published on November 25^th, 2022 and most recently updated on December 20^th, 2022.

NOTE: NCCIC-ICS has not updated their advisory (ICSA-22-354-03) to reflect this information.

Researcher Reports

Siretta Report #1 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing 46 stack-based buffer overflow vulnerabilities.

Siretta Report #2 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a directory traversal vulnerability.

Siretta Report #3 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing four command injection vulnerabilities.

Siretta Report #4 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a heap-based buffer overflow vulnerability.

Siretta Report #5 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a file write vulnerability.

Siretta Report #6 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a leftover debug code vulnerability.

Siretta Report #7 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #8 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #9 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #10 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a stack-based buffer overflow vulnerability.

Siretta Report #11 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a directory traversal vulnerability.

Siretta Report #12 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing an OS command injection vulnerability.

Siretta Report #13 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a directory traversal vulnerability.

Siretta Report #14 - Talos published a report for the Siretta QUARTZ-GOLD industrial router describing a stack-based buffer overflow vulnerability.

Zyxel Report - Positive Technologies published a report describing an improper check for unusual or exceptional conditions vulnerability in Zyxel switches.

Delta Report - Tenable published a report describing a privilege escalation vulnerability in the Delta Electronics InfraSuite Device Master.

 

For more details about these disclosures, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-e09 - subscription required.

Review – Public ICS Disclosures – Week of 10-22-22

This week we have six vendor disclosures from Aruba Networks, HP, InHand Networks, Sick, and Wireshark (2). We also have a vendor update from VMware. Then there are two researcher reports for products from Delta Electronics. Finally, we have an exploit for products from Siemens.

 

Aruba Advisory - Aruba published an advisory describing sixteen vulnerabilities in their ArubaOS.

HP Advisory - HP published an advisory that describes a denial-of-service vulnerability in a number of their printers.

InHand Advisory - InHand published an advisory that describes six vulnerabilities (with proof-of-concept code available) in their Industrial Router IR302.

Sick Advisory - Sick reportedly published an advisory that describes a password recovery vulnerability in the SIMs products, but a problem with their PSIRT web page does not allow access to the link to the advisory.

VMware Advisory - VMware published an advisory that discusses two vulnerabilities (one with known exploit) in the Cloud Foundation product.

Wireshark Advisory #1 - Wireshark published an advisory that describes a code injection vulnerability in their OPUS dissector.

Wireshark Advisory #2 - Wireshark published an advisory that describes a code injection vulnerability in their USB-HID dissector.

Delta Report #1 - Tenable published a report (with proof of concept code) describing two SQL injection vulnerabilities in the Delta DIAEnergie product.

NOTE: These appear to be separate from the three SQL injection vulnerabilities reported by NCCIC-ICS earlier this week.

Delta Report #2 - AWESEC published a report describing an SQL injection vulnerability in the Delta DIAEnergie product.

NOTE: This appears to be separate from the three SQL injection vulnerabilities reported by NCCIC-ICS earlier this week.

Siemens Exploit - RoseSecurity published a Metasploit module for an authentication bypass vulnerability in the Siemens APOGEE PXC BACnet Automation Controllers and TALON TC BACnet Automation Controllers.

 

For more details on these disclosures, including links to 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-89e - subscription required.

Review – Public ICS Disclosures – Week of 4-9-22 – Part 1 –

With this being the 2^nd Tuesday weekend, we will need two parts to look at all of the ICS disclosures. For Part 1 we have 23 vendor disclosures from ABB (3), Bentley (8), CODESYS, GE Healthcare, HMS, HPE, Palo Alto Networks (3), Phoenix Contact (3), Tanzu, and VMware. We also have five vendor updates from GE Healthcare, Hitachi Energy (2), and Palo Alto Networks (2). Then there are four researcher reports for products from PositiveGrid, and Delta Controls (3). Finally, we have three exploits for products from Franklin Fueling, Siemens, Spring.

Part 2 will look at the Schneider and Siemens disclosures published on Tuesday.

ABB Advisory #1 - ABB published an advisory discussing two vulnerabilities (one with known exploits) in their ARM600 M2M Gateway.

ABB Advisory #2 - ABB published an advisory describing a security bypass vulnerability in their Arctic Wireless Gateway.

ABB Advisory #3 - ABB published an advisory discussing the INCONTROLLER ICS attack tools.

Bentley Advisory #1 - Bentley published an advisory describing two vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #2 - Bentley published an advisory describing four vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #3 - Bentley published an advisory describing five vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #4 - Bentley published an advisory describing two vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #5 - Bentley published an advisory describing eleven vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #6 - Bentley published an advisory describing an out-of-bounds write vulnerability in their MicroStation and MicroStation-based applications.

Bentley Advisory #7 - Bentley published an advisory describing three vulnerabilities in their MicroStation and MicroStation-based applications.

Bentley Advisory #8 - Bentley published an advisory describing two vulnerabilities in their MicroStation and MicroStation-based applications.

CODESYS Advisory - CODESYS published an advisory discussing the INCONTROLLER ICS attack tools.

GE Healthcare Advisory - GE Healthcare published an advisory discussing the SpringShell vulnerability.

HMS Advisory - HMS published an advisory discussing the INFRA:HALT vulnerabilities.

HPE Advisory - HPE published an advisory describing a denial of service vulnerability in their Integrated Lights-Out 4 (iLO 4) products.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory describing an improper handling of exceptional conditions vulnerability in their PAN-OS product.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory describing a product disruption vulnerability in their Cortex XDR Agent.

Palo Alto Networks Advisory #3 - Palo Alto Networks published an advisory describing an information exposure through log files vulnerability in their Cortex XDR agent.

Phoenix Contact Advisory #1 - Phoenix Contact published an advisory discussing 56 vulnerabilities in their AXC F x152 LTS.

Phoenix Contact Advisory #2 - Phoenix Contact published an advisory discussing an infinite loop vulnerability in their FL MGUARD, TC MGUARD, mGuard Device Manager and FL WLAN devices.

Phoenix Contact Advisory #3 - Phoenix Contact published an advisory discussing an HTTP request smuggling vulnerability in their mGuard Device Manager.

Tanzu Advisory - Tanzu published an advisory describing a data binding rule vulnerability in their Spring Framework products.

NOTE: This is related to the SpringShell vulnerability.

VMware Advisory - VMware published an advisory describing a remote code execution vulnerability in their Cloud Director product.

GE Healthcare Update - GE Healthcare published an update discussing the DirtyPipe vulnerability.

Hitachi Energy Update #1 - Hitachi Energy published an update for their XMC20 advisory that was originally published on November 23^rd, 2021.

Hitachi Energy Update #2 - Hitachi Energy published an update for their FOX61x XMC20 advisory that was originally published on November 23^rd, 2021.

Palo Alto Networks Update #1 - Palo Alto Networks published an update for their OpenSSL advisory that was originally published on March 31^st, 2022.

Palo Alto Networks Update #2 - Palo Alto Networks published an update for their Spring Shell advisory that was originally published on March 31^st, 2022.

PositiveGrid Report - Tenable published a report list six vulnerabilities in the PositiveGrid Spark API.

Delta Controls Report - Zero Science Labs published three reports about vulnerabilities in the Delta Controls enteliTOUCH building controllers.

Franklin Fueling Exploit - Momen Eldawakhly published an exploit for a local file inclusion vulnerability in the Franklin Fueling Systems Colibri Controller Module.

Siemens Exploit - Sec-consult published an exploit for two vulnerabilities in the Siemens A8000 CP-8050/CP-8031 SICAM WEB.

SpringShell Exploit - Mike Pickard published an exploit for the SpringShell vulnerability.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-3c2 - subscription required.

Review – Public ICS Disclosures – Week of 10-2-21

This week we have six vendor disclosures from Aruba Networks, Bosch, Lenze, ENDRESS+HAUSER, HPE (2), and WIBU. There is also one researcher report on products from Johnson Controls.

Aruba Advisory - Aruba published an advisory describing six vulnerabilities in their Aruba Instant Access Points product.

Bosch Advisory - Bosch published an advisory describing four vulnerabilities in their Rexroth IndraMotion MLC and IndraLogic XLC products.

Lenze Advisory - CERT-VDE published an advisory discussing three vulnerabilities in a range of products from Lenze.

ENDRESS+HAUSER Advisory - CERT-VDE published an advisory discussing a stack-based buffer overflow vulnerability in the ENDRESS+HAUSER Promass 83 product.

HPE Advisory #1 - HPE published an advisory describing two vulnerabilities in their NonStop SSL Toolkit.

HPE Advisory #2 - HPE published an advisory describing an arbitrary code execution vulnerability in their HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage Arrays products.

WIBU Advisory - WIBU published an advisory describing a denial-of-service vulnerability in their CodeMeter Runtime for Windows product.

Johnson Controls Report - Tenable published a report about two vulnerabilities in the Johnson Controls exacqVision products.

For more details about these advisories, including links to third-party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10 - subscription required.

Review - Public ICS Disclosures – Week of 6-12-21

This week we have eight vendor disclosures from Digitek, EIP Stack Group, Genetec, QNAP (2), VMware, and Wibu (2). We also have two vendor updates from Dell and Mitsubishi. Finally, we have an exploit for products from Wibu.

Vendor Disclosures

Digitek Advisory - Incibe-CERT published an advisory describing an SQL injection vulnerability in the Digitek Secure 8 system.

EIP Stack Group Advisory - Incibe-CERT published an advisory describing an out-of-bounds read vulnerability in the EIP Stack Group OpENer product.

Genetec Advisory - Genetec published an advisory discussing vulnerabilities in Bosch IP cameras that may affect their Security Center, Security Center SaaS Edition, and Stratocast products.

QNAP Advisory - QNAP published an advisory describing an insecure storage of sensitive information vulnerability in their QNAP NAS products running myQNAPcloud Link.

QNAP Advisory - QNAP published an advisory describing an out-of-bounds read vulnerability in their QNAP NAS products running QTS and QuTS hero.

VMware Advisory - VMware published an advisory describing a denial-of-service vulnerability in their VMware Tools for Windows product.

Wibu Advisory - Wibu published an advisory describing a buffer over-read vulnerability in their CodeMeter Runtime Network Server.

Wibu Advisory - Wibu published an advisory describing a denial-of-service vulnerability in their CodeMeter Runtime CmWAN Server.

Vendor Updates

Dell Update - Dell published an update for their Dell Wyse Windows Embedded System that was originally published on May 11^th, 2021.

Mitsubishi Update - Mitsubishi published an update for their MC Works advisory that was originally published on June 18^th, 2020 and most recently updated on January 14^th, 2021.

Exploits

Wibu Exploit - Brian Rodriquez published an exploit for a unquoted service path vulnerability in the Wibukey Runtime product.

 

For a more detailed look at these disclosures see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-dda (subscription required),

ICS Public Disclosures – Week of 2-27-21

This week we have eight public disclosures from Bosch, Carestream, ENDRESS+HAUSER, Dell, Draeger, GE Healthcare, Pulse Secure, and VMWare. An update is available for products from Rockwell. There is an end-of-life notice from Honeywell. Finally, there is an exploit for products from VMware.

Bosch Advisory

Bosch published an advisory describing a side-channel key extraction vulnerability in the Bosch cameras and encoders built on platforms CPP-ENC, CPP3, CPP4, CPP5, CPP6, CPP7 and CPP7.3.  This is a third-party vulnerability (NXP). Since this is a chip-based vulnerability, Bosch is only able to provide generic workarounds. The original NinjaLab report on the NXP vulnerability contains proof-of-concept code.

NOTE: This third-party vulnerability was reported earlier in products from Rockwell, other vendors will probably also be affected.

Carestream Advisory

Carestream published an advisory discussing the Google heap-based buffer overflow vulnerability. Carestream provides a list of affected and unaffected products. Carestream will update Chrome in the next product release for the affected products.

ENDRESS+HAUSER Advisory

CERT-VDE published an advisory discussing the fdtCONTAINER vulnerability in a number of their products. ENDRESS+HAUSER provides generic workarounds pending development of appropriate mitigation measures in future versions of the product.

Dell Advisory

Dell published an advisory describing two vulnerabilities in their EMC OpenManage Server Administrator. The vulnerabilities were reported by David Yesland from Rhino Security Labs and Tenable. Dell has new versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Authentication bypass - CVE-2021-21513, and

• Path traversal - CVE-2021-21514

NOTE: The Tenable report contains proof-of-concept code for the

Draeger Advisory

Draeger published an advisory describing an out-of-bounds write vulnerability in their CC-Vision Basic and CC-Vision E-Cal Software. The vulnerability was reported by Mario Ceballos. Draeger had new versions that mitigate the vulnerability. There is no indication that Ceballos has been provided an opportunity to verify the efficacy of the fix.

GE Healthcare Advisory

GE Healthcare has published an advisory discussing the Microsoft Windows TCP/IP vulnerabilities. GE Healthcare reports that they are actively assessing products to see if they are affected.

Pulse Secure Advisory

Pulse Secure has published an advisory discussing the Trickboot vulnerability in their PSA-Series Hardware. Pulse Secure has a BIOS patch available that mitigates the vulnerability.

VMWare Advisory

VMWare published an advisory describing a remote code execution vulnerability in their View Planner product. The vulnerability was reported by Mikhail Klyuchnikov of Positive Technologies. VMware has a security patch that mitigates the vulnerability. There is no indication that Klyuchnikov has been provided an opportunity to verify the efficacy of the fix.

Rockwell Update

Rockwell published an update for their Logix Controllers advisory that was originally published on February 25^th, 2021. The advisory was re-written for clarity.

NOTE: I suspect the NCCIC-ICS will update their advisory on this vulnerability this coming week.

Honeywell EOL Notice

Honeywell published an end-of-life notice for their Pro-Watch 4.3 and Pro-Watch 4.35 products. The products will no longer be supported after September 30th, 2021.

VMWare Exploit

Photubias published an exploit for an unauthenticated file upload vulnerability in the VMware vCenter Server 7.0. The vulnerability was previously reported by VMWare.

1 Advisory Published – 1-28-21

Today CISA’s NCCIC-ICS published one control system security advisory for products from Rockwell Automation.

Rockwell Advisory

This advisory describes four vulnerabilities in the Rockwell FactoryTalk Linx and FactoryTalk Services Platform. The vulnerabilities were reported by Tenable. According to the Rockwell advisory, patches are available that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Improper check or handling of exceptional conditions - CVE-2020-5801 and CVE-2020-5802, and

• Buffer copy without checking size of input - CVE-2020-5806 and CVE-2020-5807 (Note #1: the NCCIC-ICS advisory lists the -5806 CVE twice, the second CVE is listed in the Rockwell advisory)

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to result in denial-of-service conditions (NOTE #2: The Tenable report provides a GitHub link for proof-of-concept code).

NOTE #3: I first discussed these vulnerabilities back on January 2^nd, 2021 and most recently on January 16^th when Rockwell published their first update. I would expect that this NCCIC-ICS advisory is based upon the second update that Rockwell published last Friday.

Public ICS Disclosures – Week of 12-26-20

This week we have two vendor disclosures for products from Moxa and Rockwell Automation.

Moxa Advisory

Moxa published an advisory discussing the Real Time Automation EtherNet/IP vulnerability. Moxa reports that none of their products are affected.

Rockwell Advisory

Rockwell published an advisory describing four vulnerabilities in their FactoryTalk Linx and FactoryTalk Services Platform. While the Rockwell advisory does not credit them with reporting the problems, Tenable has published a report discussing these same vulnerabilities and their disclosure timeline. Rockwell has provided generic mitigation measures.

The four reported vulnerabilities are:

• Unhandled exception (2) - CVE-2020-5801 and CVE-2020-5802, and

• Buffer overflow (2) - CVE-2020-5806 and CVE-2020-5807

NOTE: The Tenable report provides a GitHub link for proof-of-concept code.

Public ICS Disclosures – Week of 12-12-20

This week we have five vendor disclosures regarding the Amnesia33 vulnerabilities. There were three vendor disclosures for the SUNBURST vulnerability. There were ten other vendor disclosures for products from ABB (3), Bosch (3), WAGO, Phoenix Contact (2), and VMware. There was one vendor update from Mitsubishi. We have seven researcher reports of vulnerabilities in products from Lantronix (2), Secomea, and Eaton (4).

Amensia33 Advisories

Braun published an advisory discussing the Amnesia33 vulnerabilities. They report that none of their ‘connected devices’ is affected.

Drager published an advisory discussing the Amnesia33 vulnerabilities. They report that their medical devices are not affected.

HMS published an advisory discussing the Amnesia33 vulnerabilities. They provide a list of their products that they have confirmed are not affected.

Johnson and Johnson published an advisory discussing the Amnesia33 vulnerabilities. They report that they are investigating the potential impact of the vulnerabilities on their product line.

Spacelabs Healthcare published an advisory discussing the Amnesia 33 vulnerabilities. They report that none of their products are affected by the vulnerabilities.

Sunburst Advisories

Drager published an advisory discussing the SUNBURST vulnerability. They report that their medical devices are not affected.

Boston Scientific published an advisory discussing the SUNBURST vulnerability. They report that their products are not affected.

Philips published an advisory discussing the SUNBURST vulnerability. They report that they are monitoring developments.

ABB Advisories

ABB published an advisory [corrected link, 12-19-20 1941 EST] describing five vulnerabilities in their Central Licensing System. The vulnerabilities were reported by William Knowles at Applied Risk. ABB has new versions that mitigate the vulnerabilities. There is no indication that Knowles has been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Information disclosure - CVE-2020-8481,

• XML external entity injection - CVE-2020-8479,

• Denial of service - CVE-2020-8475,

• Elevation of privilege - CVE-2020-8476, and

• Weak file permissions - CVE-2020-8471

 

ABB published an advisory describing eight vulnerabilities in their Symphony® Plus Historian. The vulnerabilities are self-reported. ABB has an update that mitigates the vulnerabilities.

The eight reported vulnerabilities are:

• SQL injection - CVE-2020-24673,

• Improper authorization - CVE-2020-24674,

• Weak authentication - CVE-2020-24675,

• Insecure Windows services - CVE-2020-24676 -,

• Web application security - CVE-2020-24677,

• Privilege escalation - CVE-2020-24678,

• Denial of Service - CVE-2020-24679, and

• Improper credential storage - CVE-2020-24680

 

ABB published an advisory describing nine vulnerabilities in their Symphony® Plus Operations. The vulnerabilities are self-reported. ABB has an update that mitigates the vulnerabilities.

The nine reported vulnerabilities are:

• SQL injection - CVE-2020-24673,

• Improper authorization - CVE-2020-24674,

• Weak authentication - CVE-2020-24675,

• Insecure Windows services - CVE-2020-24676 -,

• Web application security - CVE-2020-24677,

• Privilege escalation - CVE-2020-24678,

• Denial of Service - CVE-2020-24679,

• Improper credential storage - CVE-2020-24680, and

• Authentication bypass - CVE-2020-24683

Bosch Advisories

Bosch published an advisory describing a null pointer dereference vulnerability in their ctrlX Products. This is a third-party OpenSSL vulnerability. Bosch has an update that mitigates the vulnerability.

 

Bosch published an advisory describing two vulnerabilities in their Rexroth IndraMotion Products. Both vulnerabilities are third-party CODESYS vulnerabilities (CVE links below are to the respective CODESYS advisories). Bosch recommends using their ctrlX CORE product to mitigate these vulnerabilities.

The two reported vulnerabilities are:

• Uncontrolled memory allocation - CVE-2020-7052 [.PDF download link], and

• Memory Corruption - CVE-2019-5105 [.PDF download link]

NOTE: Proof-of-concept code is available for the CODESYS vulnerabilities in the respective reports from Tenable and Talos.

 

Bosch published an advisory describing six vulnerabilities in their Rexroth PRC7000. These are third-party CODESYS vulnerabilities (CVE links below are to the respective CODESYS advisories). Bosch has a new firmware version that mitigates the vulnerabilities.

The six reported vulnerabilities are:

• Memory Corruption - CVE-2019-5105 [.PDF download link] Tenable report,

• Heap-based buffer overflow - CVE-2019-18858 [.PDF download link] Tenable report,

• Unverified ownership - CVE-2019-9010 [.PDF download link] NCCIC-ICS report,

• Uncontrolled memory allocation - CVE-2019-9012 [.PDF download link] NCCIC-ICS report,

• Insufficiently protected credentials - CVE-2019-9013 [.PDF download link] NCCIC-ICS report, and

• Heap-based buffer overflow - CVE-2020-10245 [.PDF download link] Tenable report.

NOTE: The respective Tenable reports include proof-of-concept code for he CODESYS vulnerabilities;

WAGO Advisory

VDE-CERT published an advisory describing an improper neutralization of special elements in an OS command vulnerability in the WAGO I/O-Check Service. The vulnerability was reported by Uri Katz of Claroty. WAGO has a new firmware version that mitigates the vulnerability.

NOTE: The Claroty report includes a Snort rule to detect the vulnerability.

Phoenix Contact Advisories

Phoenix Contact published an advisory [.PDF download link] describing a missing initialization of resource vulnerability in their mGuard products. The vulnerability was reported by SMST Designers & Constructors. Phoenix Contact has a new firmware version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

 

Phoenix Contact published an advisory [.PDF download link] describing four vulnerabilities in their PLCnext Control devices. The vulnerabilities were reported by Patrick Muench, Torsten Loebner, Maurice Rothe, Pascal Keul, Melanie Tholen and Daniel Hackel of SVA Systemvertrieb Alexander GmbH. Phoenix Contact has a new firmware version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• XSS - CVE-2020-12517,

• Exposure of sensitive information - CVE-2020-12518,

• Improper privilege management - CVE-2020-12519, and

• Improper input validation (in the PROFINET stack) - CVE-2020-12521.

NOTE: There is no indication whether the last vulnerability is unique to the Phoenix Contact implementation of PROFINET or if it is a third-party vulnerability.

VMware Advisory

VMware published an advisory describing an improper input validation vulnerability in their  ESXi, Workstation and Fusion products. The vulnerability was reported by Lucas Leong (@_wmliang_) of the Zero Day Initiative and Murray McAllister of Insomnia Security. VMware has patches that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Mitsubishi Update

Mitsubishi published an update of their Factory Automation advisory that was  originally published on July 30^th, 2020 and most recently updated on November 5^th, 2020. The new information includes providing mitigation information for GT SoftGOT1000.

NOTE: NCCIC-ICS published their advisory for this vulnerability and updated it in November.

Lantronix Reports

Talos published two reports (see CVE’s below for links) for vulnerabilities in the Lantronix XPort EDGE Web Manager. These are coordinated disclosures. The reports do not mention if the vulnerabilities have been corrected.

The two reported vulnerabilities are:

• Cleartext transmission of sensitive information - CVE-2020-13528, and

• CSRF - CVE-2020-13527

Secomea Report

Tenable published a report describing two vulnerabilities in the Secomea GateManager. This is a coordinated disclosure. The Tenable report includes proof-of-concept code. Tenable does not report that Secomea has produced any mitigation measures.

The two reported vulnerabilities are:

• Cross-site scripting - CVE-2020-29021, and

• HTTP host header injection - CVE-2020-29022

Tenable notes that these will be third-party vulnerabilities in products from at least B&R Industrial Automation and perhaps other vendors as well.

Eaton Reports

The Zero Day Initiative published four reports (see ZDI numbers for links) from Francis Provencher for vulnerabilities in the Eaton EASYsoft application. This is a coordinated disclosure but ZDI is reporting these as zero-day vulnerabilities.

The four reported vulnerabilities are:

• Out-of-bounds read - ZDI-20-1443, and

• File parsing type confusion (3) - ZDI-20-1444, ZDI-20-1442, and ZDI-20-1441

Public ICS Disclosure – Week of 7-18-20

This week we have two vendor disclosures from Phoenix Contact and CODESYS and an update from Rockwell.

 

Phoenix Contact Advisory

 

Phoenix Contact published an advisory [.PDF download link] describing an improper path sanitation on import of project files vulnerability in their PLCnext Engineer. The vulnerability was reported by Amir Preminger of Claroty. Phoenix Contact has a new version that mitigates the vulnerability.

 

CODESYS Advisory

 

CODESYS published an advisory [.PDF download link] describing an uncontrolled memory allocation vulnerability in their CODESYS V3 Visualization product. The vulnerability was reported by Tenable. The Tenable report includes proof-of-concept code. CODESYS has a new version that mitigates the vulnerability.

 

Rockwell Update

 

Rockwell published an update for their FactoryTalk View SE advisory that was originally published on June 18^th, 2020. The new information includes updated guidance given public scripts. NCCIC-ICS should update their advisory next week.

Public ICS Disclosures – Week of April 25th, 2020

This week we have two vendor disclosures for products from Moxa and BD. We also have one researcher disclosure for products from Flexera.

Moxa Advisory

Moxa published an advisory describing an unauthenticated information disclosure vulnerability in their NPort 5100A Series Serial Device Servers. The vulnerability was reported by Maayan Fishelov from SCADAfence. Moxa has a new firmware version that mitigates the vulnerability. There is no indication that Fishelov has been provided an opportunity to verify the efficacy of the fix.

BD Advisory

BD published an advisory describing a third-party scripting engine memory corruption vulnerability affecting their product line. The Internet Explorer® vulnerability was reported and fixed by Microsoft in February 2020. BD is currently working to test and validate the Microsoft patch for BD products.

Flexera Advisory

Tenable published a report describing an  improper validation of user-supplied data vulnerability in the Flexera FlexNet Publisher. This was a coordinated disclosure. Flexera has a new version that mitigates the vulnerability. The Tenable report includes proof-of-concept exploit code.

NOTE: This license management tool is used as a third-party component of many products, including some ICS products from vendors like Johnson Controls, Schneider Electric and Rockwell to name a few that have shown up invulnerability reports in the past. It will be interesting to see how fast we see the subsidiary reporting from those affected vendors.

Public ICS Disclosures – Week of 03-21-20

This week we have five vendor disclosures for products from Phoenix Contact (2), 3S (2) and Philips along with an update of a previous vendor disclosure from Belden. There is also an exploit publication for products from GE. Finally, an interesting look at control system security and COVID-19 ‘industrial distancing’.

Phoenix Contact Advisories

Phoenix Contact published an advisory [.PDF download link] describing a privilege escalation vulnerability in their Portico Remote desktop control software. The vulnerability was reported by an unnamed researcher. Phoenix Contact has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

Phoenix Contact published an advisory [.PDF download link] describing an insecure permissions vulnerability in their PC WORX SRT. The vulnerability was reported by  Sharon Brizinov of

Claroty. Phoenix Contact provides generic workarounds to mitigate the vulnerability.

3S Advisories

3S published an advisory [.PDF download link] describing an out-of-bounds memory buffer access vulnerability in their  CODESYS communication protocol. The vulnerability was reported by Carl Hurd of Cisco Talos and an OEM customer. 3S has a new version that mitigates the vulnerability. There is no indication that Hurd has been provided an opportunity to verify the efficacy of the fix.

NOTE: The Talos report includes proof-of-concept exploit code.

3S published an advisory [.PDF download link] describing a heap-based buffer overflow vulnerability in their Web Service application. The vulnerability was reported by Tenable. 3S has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

NOTE: The Tenable report includes proof-of-concept exploit code.

Philips Advisory

Philips published an advisory describing two vulnerabilities in their AC 2719 Air Purifier when using the Air Matters Android application. Philips reports that this is a chip-level problem, but reportedly a newer version of the application mitigates the vulnerabilities (?). The vulnerabilities were reported by an unnamed researcher.

The two (3 or 4 depending on where you read in the advisory) reported vulnerabilities are:

• Cleartext transmission of information;

• Insufficient Diffie Helman strength; and

• Decompiling Android app

NOTE: Okay, I will admit that I am confused by this advisory. I cannot find a researcher report of these vulnerabilities. If someone wants to step forward and explain this to me, I would appreciate it.

GE Exploit

Ivan Marmolejo has published an exploit for a password denial of service vulnerability in the GE ProficySCADA for iOS. There is no CVE number associated with the exploit report nor any vendor contact reports and I cannot find a report of a similar vulnerability on the GE security advisory page so this looks like a 0-day exploit.

COVID-19

Otorio.com has an interesting blog post about the increase in remote access to industrial systems due to COVID-19. They introduce a fun new term ‘industrial distancing’. It is a quick read, but worth it.

Public ICS Disclosure – Week of 2-15-20

This week we have four vendor disclosures for products from Phoenix Contact, Philips, BD and Belden. We also have one researcher report on products from Siemens.

Phoenix Contact Advisory

Phoenix Contact published an advisory [.PDF download link] describing an unauthenticated web server access vulnerability in their Emalytics Controllers ILC 2050 BI. The vulnerability was reported by Anil Parmar. Phoenix Contact has a new version that mitigates the vulnerability. There is no indication that Parmar has been provided an opportunity to verify the efficacy of the fix.

Philips Advisory

Philips published an advisory on the SweynTooth Bluetooth vulnerabilities. Philips is looking to see if any of their products are affected.

NOTE: The 12 disclosed vulnerabilities affect the Bluetooth Low Energy chipsets sold by major SoC vendors, such as Texas Instruments, NXP, Cypress, Dialog Semiconductors, Microchip,

STMicroelectronics and Telink Semiconductor.

BD Advisory

BD published an advisory describing Windows® 32K graphics vulnerabilities (CVE-2019-1458 and CVE-2019-1468) in their products using Windows operating systems. BD is currently working to test and validate the Microsoft patch for BD products. Microsoft included fixes for these vulnerabilities in their December 10^th, 2019 updates.

Belden Advisory

Belden published an advisory describing a buffer overflow vulnerability in their Hirschmann HiOS and HiSecOS devices. The vulnerability was reported by Sebastian Krause and Toralf Gimpel of GAI NetConsult. Belden has updates available that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Siemens Report

Tenable published a report describing a denial of service vulnerability in the Siemens TIA Portal. Siemens published their advisory on this vulnerability earlier this month. The Tenable report includes proof of concept code.

13 Advisories and 5 Updates Published – 2-11-20

Today the CISA NCCIC-ICS published 13 control system security advisories for products from Synergy Systems and Solutions, Digi International and Siemens (11). They also updated five control system security advisories for products from Siemens.

Synergy Systems Advisory

This advisory describes two vulnerabilities in the SSS HUSKY RTU. The vulnerabilities were reported by VAPT Team, C3i Center. SSS has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper authentication - CVE-2019-20046; and

• Improper input validation - CVE-2019-20045

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to read sensitive information, execute arbitrary code, or cause a denial-of-service condition.

Digi Advisory

This advisory describes two vulnerabilities in the Digi ConnectPort LTS 32 MEI. The vulnerabilities were reported by Murat Aydemir and Fatih Kayran of Biznet Bilisim. Digi has a new release that mitigates the vulnerabilities. There is no indication that the researchers have been provided with an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Unrestricted upload of file with dangerous type - CVE-2020-6975; and

• Cross-site scripting - CVE-2020-6973

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to limit system availability.

SIPROTEC Advisory

This advisory describes an improper input validation vulnerability in the Siemens SIPROTEC 4 and SIPROTEC Compact. The vulnerability was reported by Tal Keren from Claroty. Siemens has provided generic workarounds to mitigate the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to conduct a denial-of-service attack over the network.

SIMATIC S7-1500 Advisory

This advisory describes a resource exhaustion vulnerability in the Siemens SIMATIC S7-1500 CPU family. The vulnerability is self-reported. Siemens has provided generic workarounds to mitigate the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to conduct denial-of-service attacks.

SCALANCE S-600 Advisory

This advisory describes three vulnerabilities in the Siemens SCALANCE S-600 Firewall. One of the vulnerabilities was reported by Melih Berk Ekşioğlu. Siemens has provided generic workarounds to mitigate the vulnerability.

The three reported vulnerabilities are:

• Cross-site scripting - CVE-2019-6585; and

• Uncontrolled resource consumption (2) - CVE-2019-13925 and CVE-2019-13926

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to conduct denial-of-service or cross-site scripting attacks. User interaction is required for a successful exploitation of the cross-site-scripting attack.

OZW Web Server Advisory

This advisory describes and information disclosure vulnerability in the Siemens OZW web server. The vulnerability was reported by Maxim Rupp. Siemens has a new version that mitigates the vulnerability. There is no indication that Maxim has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow unauthenticated users to access project files.

SIPORT Advisory

This advisory describes an insufficient logging vulnerability in the Siemens SIPORT MP. The vulnerability is self-reported. Siemens has a new version that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow the attacker to create special accounts with administrative privileges.

SCALANCE Advisory

This advisory describes a protection mechanism failure vulnerability in the Siemens SCALANCE X switches. The vulnerability is self-reported. Siemens has updates that mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to perform administrative actions.

SIMATIC PCS 7 Advisory

This advisory describes an incorrect calculation of buffer size vulnerability in the Siemens SIMATIC PCS 7, SIMATIC WinCC, SIMATIC NET PC products. The vulnerability was reported by Nicholas Miles from Tenable. Siemens has new versions that mitigate the vulnerability. There is no indication that Miles has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker with network access to cause a denial-of-service condition.

SIMATIC S7 Advisory

This advisory describes a resource exhaustion vulnerability in the Siemens SIMATIC S7 devices. The vulnerability was reported by China Industrial Control Systems Cyber Emergency Response Team. Siemens has a new version that mitigates the vulnerability. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow remote attackers to perform a denial-of-service attack by sending a specially crafted HTTP request to the web server of an affected device.

PROFINET Advisory

This advisory describes a resource exhaustion vulnerability in the Siemens PROFINET-IO Stack. The vulnerability was reported by Yuval Ardon and Matan Dobrushin of OTORIO. Siemens has updates that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to lead to a denial-of-service condition.

NOTE: OTORIO reports that this same vulnerability is found in multiple vendor products including the Moxa EDS Ethernet Switches.

SIMATIC CP Advisory

This advisory describes two vulnerabilities in the Siemens SIMATIC CP 1543-1. The vulnerabilities are self-reported. Siemens has a new version that mitigates the vulnerabilities.

The two reported vulnerabilities are:

• Improper access control - CVE-2019-12815; and

• Loop with unreachable exit condition - CVE-2019-18217

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow for remote code execution and information disclosure without authentication, or unauthenticated denial of service.

Industrial Products Advisory

This advisory describes two vulnerabilities in the Siemens SCALANCE, SIMATIC, SIPLUS products. The vulnerabilities were reported by Artem Zinenko of Kaspersky Lab. Siemens has new versions that mitigate the vulnerabilities. There is no indication that Zinenko has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Data processing errors - CVE-2015-5621; and

• Null pointer dereference - CVE-2018-18065

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow remote attackers to conduct a denial-of-service attack by sending specially crafted packets to Port 161/UDP (SNMP).

SIMOCODE Update

This update provides additional information on an advisory that was originally published on March 9th, 2019 and most recently updated on January 14^th, 2020. The new information includes the addition of two affected products:

• SITOP PSU8600; and

• TIM 1531 IRC

Industrial Products w/OPC UA Update

This update provides additional information on an advisory that was originally published on April 9th, 2019 and most recently updated on January 14^th, 2020. The new information includes updated affected version data and mitigation links for SIMATIC NET PC Software.

PROFINET Update

This update provides additional information on an advisory that was originally published on October 10^th, 2019 and most recently updated on January 14^th, 2020. The new information includes updated affected version data and mitigation links for SINAMICS DCP.

Industrial Real Time Devices Update

This update provides additional information on an advisory that was originally published on October 10^th, 2019 and most recently updated on January 14^th, 2020. The new information includes updated affected version data and mitigation links for SINAMICS DCP.

SIMATIC Update

This update provides additional information on an advisory that was originally published on December 10th, 2019. The new information includes updated affected version data and mitigation links for:

• TIM 1531 IRC;

• SIMATIC NET PC Software

Other Siemens Advisories and Updates

Siemens also published two additional advisories and 3 updates yesterday that have not yet been addressed by NCCIC-ICS.

Additionally, on Monday Siemens published updates of 58 previously published advisories. All of these updates were adding references to the SIPLUS device variants as affected products. Siemens has been adding references to this as they have been updating advisories for the last couple of months, so it looks like they are just doing the final house cleaning on the issue. I do not expect NCCIC-ICS to update all of their applicable advisories.

Public ICS Disclosures – Week of 1-18-20

This week we have one vendor disclosure from 3S.

CODESYS Advisory

3S published an advisory [.PDF download link] describing an uncontrolled resource allocation vulnerability in the CODESYS V3 products containing communication servers for the CODESYS communication protocol. The vulnerability was reported [NOTE: includes proof of concept code] by Tenable. 3S has a new version that mitigates the vulnerability.

3S notes that a relatively low-skilled attacker could remotely exploit this vulnerability with publicly available exploit code to cause a denial-of-service condition.