Review – 3 Advisories and 1 Update Published – 10-24-24

Today, CISA’s NCCIC-ICS published three control system security advisories for products from Deep Sea Electronics, iniNet Solutions and VIMESA. They also updated an advisory for products from OMNTEC.

Advisories

Deep Sea Advisory - This advisory describes a missing authentication for critical function vulnerability in the Deep Sea DSE855 ethernet communications device.

iniNet Advisory - This advisory describes a path traversal vulnerability in the iniNet SpiderControl SCADA PC HMI Editor software management platform.

VIMESA Advisory - This advisory describes an improper access control vulnerability in the VIMESA VHF/FM Transmitter Blue Plus.

Updates

OMNTEC Update - This update provides additional information on the Proteus Tank Monitoring advisory that was originally published on September 24^th, 2024.

 

For more details about these advisories, including a down-the-rabbit-hole look at additional Deep Sea vulnerabilities, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-1-update-published-81e - subscription required.

Review – Public ICS Disclosures – Week of 2-10-24 – Part 2

For Part 2 we have four additional vendor disclosures from Schneider (3) and WatchGuard. There are also ten vendor updates from Dell, Schnieder, and Siemens (8). Finally, we have two exploits for products from Vimesa and Splunk.

Advisories

Schneider Advisory #1 - Schneider published an advisory that describes three vulnerabilities in multiple Schneider products.

Schneider Advisory #2 - Schneider published an advisory that describes an improper authentication vulnerability in their Harmony Relay NFC products.

Schneider Advisory #3 - Schneider published an advisory that describes a use of hard-coded credentials vulnerability in their EcoStruxure IT Gateway product.

Updates

Dell Update - Dell published an update for their Wyse Management Suite advisory that was originally published on December 19^th, 2022.

Schneider Update - Schneider published an update for their Modicon Controllers advisory that was originally published on May 14^th, 2019 and most recently updated on March 14^th, 2023.

Siemens Update #1 - Siemens published an update for their User Management Component advisory that was originally published on December 12^th, 2023 and most recently updated on January 9^th, 2024.

Siemens Update #2 - Siemens published an update for their Linux Kernel of the SIMATIC S7-1500 advisory that was originally published on June 13^th, 2023 and most recently updated on January 9^th, 2024.

Siemens Update #3 - Siemens published an update for their OPC UA Implementations advisory that was originally published on September 12^th, 2023 and most recently updated on January 9^th, 2024.

Siemens Update #4 - Siemens published an update for their GNU/Linux subsystem of the SIMATIC S7-1500 that was originally published on November 27^th, 2018 and most recently updated on December 12^th, 2023.

Siemens Update #5 - Siemens published an update for their DHCP Client of Nucleus RTOS advisory that was originally published on November 12^th, 2023.

Siemens Update #6 - Siemens published an update for their GNU/Linux subsystem of the SIMATIC S7-1500 CPU advisory that was originally published on December 12^th, 2023 and most recently updated on January 9^th, 2024.

Siemens Update #7 - Siemens published an update for their Siemens Industrial Products advisory that was originally published on August 10^th, 2021 and most recently updated on November 14^th, 2023.

Siemens Update #8 - Siemens published an update for their IPv6 Stack of Nucleus RTOS advisory that was originally published on April 13^th, 2021 and most recently updated on November 9^th, 2021.

Exploits

Vimesa Exploit - LIQUIDWORM published an exploit for a denial of service vulnerability in the Vimsea Blue Plus VHF/FM radio transmitter.

Splunk Exploit - Parsa Rezaie Khiabanloo published an exploit for an information disclosure vulnerability in Splunk.

 

For more information about these disclosures, including a brief summary of changes made in updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-d2a - subscription required.