1 Update Published – 08-08-19

Today the DHS NCCIC-ICS published an update for a previously issued control system security advisory for products from Wind River.

The update provides additional information on an advisory that was originally published on July 30^th, 2019. The new information is the addition of two new vendor advisories concerning the VxWorks vulnerabilities:

• Schneider advisory; and

• Draeger (advisory not published on Draeger site?)

I reported the Schneider advisory last Saturday, along with advisories from Siemens, ABB, and Belden that were not included in this update.

One Update Published – 02-21-19

NCCIC-ICS published an update of a control system security advisory for products from Wind River. The advisory was originally published on April 1^st, 2013. The updated information includes:

• Adds GE D20MX as an affected product;

• Changes characterization of CVE-2013-0715 from ‘Command Injection’ to ‘Improper Input Validation’; and

• Provides GE mitigation measures for vulnerabilities.

There must be an interesting story here, just do not know what it is.