Review - Siemens Published Out-of-Zone Advisory – 11-18-19

Yesterday Siemens published an advisory for ten vulnerabilities in their Tecnomatix Plant Simulation product. This comes almost one week after they published 12 advisories and 13 updates on Cyber Tuesday. Looking at the related ZDI advisories, it appears that Siemens published this out-of-zone advisory today as part of a coordinated disclosure agreement with the Zero Day Initiative and the researcher reporting the vulnerabilities.

 

For more details about the advisory, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/siemens-published-out-of-zone-advisory - subscription required.

Review – Public ICS Disclosures – Week of 8-5-23 – Part 2

For Part 2 we have a vendor disclosure for products from Schneider. There are also 17 vendor updates from B&R, FortiGuard, Schneider (3) and Siemens (12). Finally, we have 20 researcher reports for products from Advantech, BlueMark, NVIDIA, Softing (11), and Inductive Automation (6).

Advisories

Schneider Advisory - Schneider published an advisory that describes an improper restriction of operations within the bounds of a memory buffer in their Pro-face GP-Pro EX product.

Updates

B&R Update - B&R published an update for their SLP based traffic advisory that was originally published on May 31^st, 2023.

FortiGuard Update - FortiGuard published an update for their FortiOS buffer overflow advisory that was originally published on July 28^th, 2023.

Schneider Update #1 - Schneider published an update for their EcoStruxure Control Expert advisory that was originally published on January 10^th, 2023, and most recently updated on March 14^th, 2023.

Schneider Update #2 - Schneider published an update for their EcoStruxure Control Expert advisory that  was originally published on January 10^th, 2023, and most recently updated on July 11^th, 2023.

Schneider Update #3 - Schneider published an update for their CODESYS Runtime advisory that was originally published on July 11^th, 2023.

Siemens Update #1 - Siemens published an update for their Multiple File Parsing advisory that was originally published on May 9^th, 2023.

Siemens Update #2 - Siemens published an update for their Authentication Bypass advisory that was originally published on March 14^th, 2023 and most recently updated on June 13^th, 2023.

Siemens Update #3 - Siemens published an update for their Linux Kernel advisory that was originally published on June 13^th, 2023 and most recently updated on July 11^th, 2023.

Siemens Update #4 - Siemens published an update for their File Parsing Vulnerabilities advisory that was originally published on July 11^th, 2023.

Siemens Update #5 - Siemens published an update for their OPC Foundation advisory that was originally published on April 11^th, 2023 and most recently updated on June 13^th, 2023.

Siemens Update #6 - Siemens published an update for their IPU 2022.3 Vulnerabilities advisory that was originally published on February 14^th, 2023 and most recently updated on July 11^th, 2023.

Siemens Update #7 - Siemens published an update for their Missing CSRF Protection advisory that was originally published on November 8^th, 2022, and most recently updated on July 11^th, 2023.

Siemens Update #8 - Siemens published an update for their additional GNU/Linux subsystem advisory that was originally published on November 27^th, 2018 and most recently updated on July 11^th, 2023.

Siemens Update #9 - Siemens published an update for their Insyde BIOS Vulnerabilities advisory that was originally published on May 22^nd, 2022 and most recently updated on July 11^th, 2023.

Siemens Update #10 - Siemens published an update for their SISCO Stack Vulnerability advisory that was originally published on December 13^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #11 - Siemens published an update for their Privilege Management Vulnerability advisory that was originally published on December 13^th, 2022. 

Researcher Reports

Advantech Report - CyberDanube published a report that describes two cross-site scripting vulnerabilities in the Advantech EKI-1524-CE series, EKI-1522 series, EKI-1521 series products.

BlueMark Reports - Nozomi Networks published three reports about individual vulnerabilities in the BlueMark DroneScout ds230 Remote ID receiver.

NVIDIA Reports - Cisco TALOS published three reports for individual vulnerabilities in the NVIDIA GPU Display Driver.

Softing Report #1 - ZDI published a report that describes a resource exhaustion vulnerability in the Softing edgeConnector product.

Softing Report #2 - ZDI published a report that describes a directory traversal vulnerability in the Softing Integration Server.

Softing Reports #3-5 - ZDI published three reports of individual vulnerabilities in the Softing edgeAggregator.

Softing Reports #6-9 - ZDI published four reports of individual vulnerabilities in the Softing Secure Integration Server.

Softing Report #10 - ZDI published a report of a NULL pointer dereference vulnerability in the Softing edgeConnector.

Softing Report #11 - ZDI published a report of a hard-coded cryptographic key vulnerability in the Softing Secure Integration Server.

Inductive Automation Reports - ZDI published six reports of vulnerabilities in the Inductive Automation Ignition product.

 

For more details on these disclosures, including a brief summary of changes made in updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-1b8 - subscription required.

Review – Public ICS Disclosures – Week of 4-29-23

This week we have 23 vendor disclosures from Broadcom (6), FortiGuard Labs (9), HMS, Honeywell, HP, Insyde (2), OPC Foundation (2), and Philips. We have five researcher reports for vulnerabilities in products from Sante. Finally, we have an exploit report for products from FortiGuard.

Advisories

Broadcom Advisory #1 - Broadcom published an advisory that discusses a cleartext transmission of sensitive information vulnerabilities in multiple Brocade products.

Broadcom Advisory #2 - Broadcom published an advisory that discusses an HTTP request/response smuggling vulnerability in multiple Brocade products.

Broadcom Advisory #3 - Broadcom published an advisory that discusses an allocation of resources without limit or throttling vulnerability in multiple Brocade products.

Broadcom Advisory #4 - Broadcom published an advisory that discusses a data processing error vulnerability in multiple Brocade products.

Broadcom Advisory #5 - Broadcom published an advisory that discusses a deserialization of untrusted data vulnerability in multiple Brocade products.

Broadcom Advisory #6 - Broadcom published an advisory that discusses a deserialization of untrusted data vulnerability in multiple Brocade products.

FortiGuard Advisory #1 - FortiGuard published an advisory that describes an out-of-bounds write vulnerability in their FortiOS and FortiProxy products.

FortiGuard Advisory #2 - FortiGuard published an advisory that describes an open redirect vulnerability in their FortiNAC product.

FortiGuard Advisory #3 - FortiGuard published an advisory that describes a use of hard-coded credentials vulnerability in their FortiNAC product.

FortiGuard Advisory #4 - FortiGuard published an advisory that describes an insufficiently protected credentials vulnerability in their FortiNAC.

FortiGuard Advisory #5 - FortiGuard published an advisory that describes a weak authentication vulnerability in their FortiNAC product.

FortiGuard Advisory #6 - FortiGuard published an advisory that describes a cross-site scripting vulnerability in their FortiNAC product.

FortiGuard Advisory #7 - FortiGuard published an advisory that describes a weak cryptographic algorithm vulnerability in their FortiNAC product.

FortiGuard Advisory #8 - FortiGuard published an advisory that describes a path traversal vulnerability in their FortiADC product.

FortiGuard Advisory #9 - FortiGuard published an advisory that describes an OS command injection vulnerability in their FortiADC product.

HMS Advisory - HMS published an advisory that discusses an authentication bypass by capture replay vulnerability in their Anybus Wireless Bridge II/Bolt.

Honeywell Advisory - Honeywell published an end-of-life notice for multiple products.

HP Advisory -HP published an advisory that discusses eleven vulnerabilities in multiple HP products.

Insyde Advisory #1 - Insyde published an advisory that describes an out-of-bounds read vulnerability in their InsydeCrPkg.

Insyde Advisory #2 - Insyde published an advisory that describes an inadequate input validation vulnerability in multiple Intel mobile platforms.

OPC Foundation Advisory #1 - The OPC Foundation published an advisory that describes an improperly controlled sequential memory allocation vulnerability in their OPC UA .NET Standard Reference Server.

OPC Foundation Advisory #2 - The OPC Foundation published an advisory that describes a generation of error message that contains sensitive information vulnerability in their OPC UA .NET Standard Reference Server.

Philips Advisory - Philips published an advisory that discusses the Windows WinVerifyTrust Signature Validation Vulnerability.

Researcher Reports

Sante Reports - The Zero Day Initiative published reports for five vulnerabilities in the Sante DICOM Viewer Pro.

Exploits

FortiGuard Exploit - Code16 published an exploit for an unspecified vulnerability in FortiGate-VM64.

 

For more details about these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-837 - subscription required.

Review – Public ICS Disclosures – Week of 4-8-23 – Part 3

For Part 3, we have 35 vendor updates from Schneider (4) and Siemens (31). We also have a researcher report for products from Triangle Microworks. Finally, we have five exploits for products from Paradox Security, Palo Alto Networks, FortiGuard, Schneider Electric, and Franklin Fueling Systems.

Updates

Schneider Update #1 - Schneider published an update for their EcoStruxure™ Control Expert advisory that was originally published on January 10^th, 2023 and most recently updated on March 14^th, 2023.

Schneider Update #2 - Schneider published an update for their SCADAPack Workbench advisory that was originally published on March 28^th, 2023.

Schneider Update #3 - Schneider published an update for their CODESYS V3 Runtime that was originally published on January 11^th, 2022 and most recently updated on March 14^th, 2023.

Schneider Update #4 - Schneider published an update for their BadAlloc advisory that was originally published on November 9^th, 2021 and most recently updated on March 14^th, 2023.

Siemens Update #1 - Siemens published an update for their SNMP in Multiple Industrial Products advisory that was originally published on February 11^th, 2020 and most recently updated on June 14^th, 2022.

Siemens Update #2 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on July 12^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #3 - Siemens published an update for their SIMATIC WinCC advisory that was originally published on November 9^th, 2021 and most recently updated on July 12^th, 2022.

Siemens Update #4 - Siemens published an update for their Industrial Products advisory that was originally published on February 28^th, 2022 and most recently updated on July 12^th, 2022.

Siemens Update #5 - Siemens published an update for their Polarion ALM advisory that was originally published on December 13^th, 2022.

Siemens Update #6 - Siemens published an update for their RUGGEDCOM ROS-based V4 advisory that was originally published on November 8^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #7 - Siemens published an update for their PROFINET-IO (PNIO) stack advisory that was originally published on November 11^th, 2020 and most recently updated on June 14^th, 2022.

Siemens Update #8 - Siemens published an update for their OpenSSL component advisory that was originally published on June 14^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #9 - Siemens published an update for their SCALANCE advisory that was originally published on August 9^th, 2022 and most recently updated on January 10^th, 2023.

Siemens Update #10 - Siemens published an update for their Teamcenter Visualization and JT2Go advisory that was originally published on December 13^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #11 - Siemens published an update for their SCALANCE X-200 and X-300/X408 advisory that was originally published on September 14^th, 2021 and most recently updated on March 12^th, 2022.

Siemens Update #12 - Siemens published an update for their SIMATIC CP 343-1 Advanced/CP-443-1 advisory that was originally published on November 21^st, 2016 and most recently updated on December 10^th, 2019.

Siemens Update #13 - Siemens published an update for their Industrial Products advisory that was originally published on March 20^th, 2018 and most recently updated on January 10^th, 2023.

Siemens Update #14 - Siemens published an update for their SIMATIC S7-400 CPU advisory that was originally published on March 12^th, 2022 an most recently updated on August 9^th, 2022.

Siemens Update #15 - Siemens published an update for their Web Interface of SCALANCE and RUGGEDCOM Products advisory that was originally published on October 11^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #16 - Siemens published an update for their SIMATIC NET CP advisory that was originally published on September 14^th, 2021 and most recently updated on June 14^th, 2022.

Siemens Update #17 - Siemens published an update for their Webserver of Industrial Products advisory that was originally published on April 9^th, 2019 and most recently updated on January 10^th, 2023.

Siemens Update #18 - Siemens published an update for their Web Server Login Page of Industrial Controllers advisory that was originally published on November 8^th, 2022 and most recently updated on January 10^th, 2023.

Siemens Update #19 - Siemens published an update for their  TCP SACK PANIC advisory that was originally published on September 10^th, 2019 and most recently update on June 14^th, 2022.

Siemens Update #20 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on September 13^th, 2022 and most recently updated on November 8^th, 2022.

Siemens Update #21 - Siemens published an update for their PROFINET Stack advisory that was originally published on March 12^th, 2022 and most recently updated on February 14^th, 2023.

Siemens Update #22 - Siemens published an update for their SCALANCE advisory that was originally published on December 13^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #23 - Siemens published an update for their OpenSSL 3.0 advisory that was originally published on December 13^th, 2022.

Siemens Update #24 - Siemens published an update for their Industrial Products advisory that was originally published on December 13^th, 2022 and most recently updated on January 10^th, 2023.

Siemens Update #25 - Siemens published an update for their Industrial Real-Time Devices advisory that was originally published on October 8^th, 2019 and most recently updated on January 10^th, 2023.

Siemens Update #26 - Siemens published an update for their OPC Foundation advisory that was originally published on May 10^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #27 - Siemens published an update for their SCALANCE X advisory that was originally published on July 12^th, 2022.

Siemens Update #28 - Siemens published an update for their SIMATIC PCS 7 advisory that was originally published on February 11^th, 2020 and most recently updated on April 12^th, 2022.

Siemens Update #29 - Siemens published an update for their RUGGEDCOM ROS advisory that was originally published on March 8^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #30 - Siemens published an update for their OpenSSL advisory that was originally published on February 8^th, 2022 and most recently updated on March 14^th, 2023.

Siemens Update #31 - Siemens published an update for their VX-Works advisory that was originally published on March 14^th, 2020 and most recently updated on June 14^th, 2022.

Researcher Reports

Triangle Microworks Report - The Zero Day Initiative published a report that describes a remote code execution vulnerability in the Triangle Microworks SCADA Data Gateway.

Exploits

Paradox Security Exploit - Giorgi Dograshvili published an exploit for a code injection vulnerability in the Paradox IPR512 IP monitoring receiver.

Palo Alto Networks Exploit - OMURUGUR published an exploit for a stored cross-site scripting vulnerability in the Palo Alto Networks Cortex XSOAR product.

FortiGuard Exploit - Mohammed Adel published an exploit for an uncontrolled resource consumption vulnerability in the FortiGuard FortiRecorder.

Schneider Exploit - Parsa Rezaie Khiabanloo published an exploit for a directory traversal vulnerability in an inadequately identified (SCADA-vis?) Schneider product.

Franklin Fueling Exploit - Parsa Rezaie Khiabanloo published an exploit for an information disclosure vulnerability in the Franklin Fuel Systems TS-550.

 

For more details about these disclosures, including a brief summary of the changes made in the updates, please see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-015 - subscription required.

Review – Public ICS Disclosures – Week of 2-4-23

This week we have eleven vendor disclosures from ABB, Baicells, Dahua, Palo Alto Networks (5), Ruckus, and Zyxel Networks (2). We also have three vendor updates from CONTEC, HPE, and Moxa. Finally, we have thirteen researcher reports on products from Siemens, and Open Design Alliance (12).

NOTE: There have been problems with the NIST NVD CVE listings this morning. They have been slow to load or have not been found. Hopefully this will be corrected in the near future.

Vendor Disclosures

Baicells Advisory - Baicells published an advisory that describes a cross-site scripting vulnerability in their Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices.

Dahua Advisory - Dahua published an advisory that describes an unauthorized modification of device timestamp vulnerability in some of their embedded products.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory that discusses an improper privilege management vulnerability in SUDO.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory that discusses the OpenSSL vulnerabilities disclosed Feb 7, 2023.

Palo Alto Networks Advisory #3 - Palo Alto Networks published an advisory that describes a protection mechanism failure vulnerability in their Cortex XDR agent.

Palo Alto Networks Advisory #4 - Palo Alto Networks published an advisory that describes an information disclosure vulnerability in their Cortex XDR agent.

Palo Alto Networks Advisory #5 - Palo Alto Networks published an advisory that describes a file disclosure vulnerability in their Cortex XSOAR server.

Ruckus Advisory - Ruckus published an advisory that describes a cross-site request forgery vulnerability in multiple products using their AP Web application.

NOTE: Multiple end-of-life products are listed as being affected by this vulnerability.

Zyxel Advisory #1 - Zyxel published an advisory that describes a command injection vulnerability in their firewalls.

Zyxel Advisory #2 - Zyxel published an advisory that describes an improper check for unusual or exceptional conditions vulnerability in their Aps.

Vendor Updates

CONTEC Update - JP CERT published an update for their Solar View Compact advisory that was originally published on May 26^th, 2022 and most recently updated on December 13^th, 2022.

HPE Update - HPE published an update for their OneView advisory that was originally published on January 31^st, 2023.

Moxa Update - Moxa published an update for their UC Series advisory that was originally published on November 29^th, 2023.

NOTE: NCCIC-ICS has not updated their advisory (ICSA-22-333-04) for this new information.

Researcher Reports

Siemens Report - Otorio published a report describing two vulnerabilities in the Siemens Automation License Manager.

ODA Report #1 - The Zero Day Initiative published a report that describes a memory corruption vulnerability in the ODA Drawing SDK.

ODA Report #2 - ZDI published a report that describes a memory corruption vulnerability in the ODA Drawing SDK.

ODA Report #3 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report # 4 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #5 - ZDI published a report that describes a heap-based buffer overflow vulnerability in the ODA Drawing SDK.

ODA Report #6 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #7 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #8 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report # 9 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #10 - ZDI published a report that describes an out-of-bounds write vulnerability in the ODA Drawing SDK.

ODA Report #11 - ZDI published a report that describes a heap-based buffer overflow vulnerability in the ODA Drawing SDK.

ODA Report #12 - ZDI published a report that describes a use-after-free vulnerability in the ODA Drawing SDK.

 

For more details about these disclosures, including links to third-party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-6e9 - subscription required.

Review – Public ICS Disclosures – Week of 8-20-22

This week we have five vendor disclosures from ABB, GE Gas Power (2), HP, and VMware. There is a vendor updates from Dell. Finally, there is a researcher report for products from Omron.

ABB Advisory - ABB published an advisory that discusses a an improper restriction of operations within the bounds of a memory buffer vulnerability in their ARM600 M2M Gateway.

GE Advisory #1 - GE published an advisory that describes an HTTP request/response splitting vulnerability in their Workstation ST products.

GE Advisory #2 - GE published an advisory that describes a cross-site scripting vulnerability in their Workstation ST products.

HP Advisory - HP published an advisory that describes a denial-of-service vulnerability in their HP PageWide Pro printers.

VMware Advisory - VMware published an advisory that describes a privilege escalation vulnerability in their VMware Tools product.

NOTE: This is being reported as a third-party vulnerability on some Linux distributions by OpenWall and Debian. This may show up as a third-party vulnerability in other products.

Dell Update - Dell published an update for their Log4Shell advisory.

Omron Report - The Zero Day Initiative published a report describing a use-after-free vulnerability in the Omron CS-One CX Programmer module.

 

For more details about these disclosures, including links to third-party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-8-9dc - subscription required.

Review – Public ICS Disclosures – Week of 7-9-22 – Part 2

For part two we start with five vendor disclosures from Inductive Automation, and Schneider Electric (4). We also have thirteen vendor updates from Fanuc, HPE (2), OPC Foundation, Schneider (6), and Siemens (3). Finally, we have one researcher report on products from Festo.

Inductive Automation Advisory - Inductive Automation published a blog post on five vulnerabilities in their Ignition control server that were discovered during the Pwn-to-Own competition at the recent S4x22 conference.

Schneider Advisory #1 - Schneider published an advisory that describes seven vulnerabilities in their OPC UA and X80 Advanced RTU Modicon communications modules.

Schneider Advisory #2 - Schneider published an advisory that describes an OS command injection vulnerability in their SpaceLogic C-Bus Home Controller.

Schneider Advisory #3 - Schneider published an advisory that describes an improper privilege management vulnerability in their Acti9 PowerTag Link C product.

Schneider Advisory #4 - Schneider published an advisory that describes three vulnerabilities in their Easergy P5 product line.

Fanuc Update - Fanuc published an update for their ROBOGUIDE advisory that was originally published on April 8^th, 2022 and most recently updated on April 27^th, 2022.

HPE Update #1 - HPE published an update for their ProLiant BL/DL/ML/XL/MicroServer advisory that was originally published on June 14^th, 2022.

HPE Update #2 - HPE published an update for their ProLiant BL/DL/ML/XL/MicroServer advisory that was  originally published on May 10^th, 2022 and most recently updated on June 22^nd, 2022.

OPC Foundation Update - The OPC Foundation published an update for their OPC UA .NET Standard Stack advisory that was originally published on May 1^st, 2022.

Schneider Update #1 - Schneider published an update for their CODESYS V3 Runtime advisory that was originally published on January 11^th, 2022 and most recently updated on April 12^th, 2022.

Schneider Update #2 - Schneider published an update for their APC Smart-UPS advisory that was originally published on March 8^th, 2022 and most recently updated on June 14^th, 2022.

Schneider Update #3 - Schneider published an update for their IGSS advisory that was originally published on April 12^th, 2022

Schneider Update #4 - Schneider published an update for their ATT Labs Compressor advisory that was originally published on August 10^th, 2021 and most recently updated on April 12^th, 2022.

Schneider Update #5 - Schneider published an update for their EcoStruxure advisory that was originally published on July 13^th, 2021 and most recently updated on April 12^th, 2022.

Schneider Update #6 - Schneider published an update for their EcoStruxureTM Control Expert advisory that was originally published on September 14^th, 2021, and most recently updated on March 8^th, 2022.

Siemens Update #1 - Siemens published an update for their GNU/Linux advisory that was  originally published in 2018 and most recently updated on June 14^th, 2022.

Siemens Update #2 - Siemens published an update for their Insyde Bios advisory that was originally published on February 22^nd, 2022 and most recently updated on March 8^th, 2022.

Siemens Update #3 - Siemens published an update for their OpenSSL advisory that was originally reported on July 13^th, 2021 and most recently updated on June 14^th 2022.

Festo Report - OneKey published a report discussing four vulnerabilities in the FESTO Controller CECC-X-M1.

 

For more details on these disclosures, including brief description of update changes, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-7-094  - subscription required.

Review – Public ICS Disclosures – Week of 4-23-22 – Part 2

This week for Part 2 we have two additional vendor disclosures from Dell and Johnson Controls. There are also seven vendor updates from Bayer, FANUC, HP, Palo Alto Networks, QNAP, Siemens, and Yokogawa. Finally, there are four researcher reports for products from Delta Industrial (3) and Santesoft,

Dell Advisory - Dell published an advisory discussing an infinite loop vulnerability in their Wyse ThinOS products.

Johnson Controls Advisory - Johnson Controls published an advisory discussing the SpringShell vulnerabilities.

Bayer Update - Bayer published an update for their Log4Shell and Access:7 advisory that was originally published on March 8^th, 2022.

FANUC Update - FANUC published an update for their ROBOGUIDE advisory that was originally published on April 8^th, 2022.

HP Update - HP published an update for their Expat Library advisory for their PCoIP products that was originally published on April 11^th, 2022.

Johnson Controls Update - Johnson Controls published an update for their SpringShell advisory that was originally published on April 19^th, 2022.

Palo Alto Networks Update - Palo Alto Networks published an update for their Cortex XDR Agent advisory that was originally published on April 13^th, 2022

QNAP Update - QNAP published an update for their Apache HTTP server advisory that was originally published on April 20^th, 2022.

Siemens Update - Siemens published an update for their SpringShell advisory that was originally published on April 19^th, 2022.

Yokogawa Update - Yokogawa published an update for their Centum advisory that was originally published on January 14^th, 2022 and most recently updated on March 16^th, 2022.

Delta Reports - The Zero Day Initiative published three 0-day reports about vulnerabilities from Delta Industrial.

Santesoft - ZDI published a report describing an out-of-bounds write vulnerability in the Santesoft DICOM Viewer Pro.

 

For more details about these advisories and updates, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-239  - subscription required.

Review – Public ICS Disclosures – Week of 3-26-22 – Part 2

In Part 2 we have ten additional vendor disclosures from Beckman Coulter, PulseSecure, QNAP (2), Rockwell Automation, Tanzu (3), VMware and Western Digital. There are also vendor updates from Dell and Siemens. Finally, we have two researcher reports about vulnerabilities in products from Siemens.

Beckman Coulter Advisory - Beckman published an advisory discussing the PrintNightmare vulnerability.

PulseSecure Advisory - PulseSecure published an advisory discussing an infinite loop vulnerability in multiple products.

QNAP Advisory #1 - QNAP published an advisory discussing the DirtyPipe vulnerability.

QNAP Advisory #2 - QNAP published an advisory discussing an infinite loop vulnerability in their QNAP NAS products.

Rockwell Advisory - Rockwell published an advisory describing an XML external entity vulnerability in their Workbench products.

Tanzu Advisory #1 - Tanzu published an advisory discussing a denial-of-service vulnerability in their Spring Framework products.

Tanzu Advisory #2 - Tanzu published an advisory describing a command injection vulnerability in their Spring Cloud Function.

Tanzu Advisory #3 - Tanzu published an advisory discussing the SpringShell vulnerability.

VMware Advisory - VMware published an advisory describing an information disclosure vulnerability in their vCenter Server.

Western Digital Advisory - Western Digital published an advisory describing a DLL hijacking vulnerability in their G-RAID 4/8 Software Utility.

Dell Update - Dell published an update for their Log4Shell advisory.

Siemens Update - Siemens published an update for their SegmentSmack advisory that was originally published on April 14^th, 2020 and most recently updated on March 11^th, 2022.

Siemens Reports - The Zero Day Initiative published two reports (here and here) about vulnerabilities in the Siemens Simcenter Femap simulation application.

 

For more details about these disclosures, including links to researcher reports and third-party vendor advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-3-008 - subscription required.

Review - Public ICS Disclosures – Week of 2-19-22

This week we have twelve vendor disclosures from Aruba, GE Gas Power (2), Hitachi, Insyde (3), HPE, PulseSecure, QNAP, Siemens, and VMware. We have five vendor updates from Aruba, Dell, HPE, Johnson Controls, and Milestone. We also have 19 researcher reports for products from WECON (15), Fuji Electric (3), and Industrial Control Links (ICL). Finally we have three exploits reported for products from ICL and WebHMI (2).

Aruba Advisory - Aruba published an advisory describing 16 vulnerabilities in their AOS-CX Switches. Some of these are third-party vulnerabilities.

GE Gas Power Advisory #1 - GE published an advisory discussing the GE CIMPLICITY vulnerabilities reported earlier this week.

GE Gas Power Advisory #2 - GE published an advisory discussing the Blackberry QNX Neutrino Kernel vulnerability.

Hitachi Advisory - Hitachi published an advisory discussing 20 recently reported Microsoft vulnerabilities affecting their Hitachi Disk Array Systems.

Insyde Advisory #1 - Insyde published an advisory describing a privilege escalation vulnerability in their SysPasswordDxe driver.

Insyde Advisory #2 - Insyde published an advisory describing a buffer overflow vulnerability in their VariableEditSmm driver.

Insyde Advisoyr #3 - Insyde published an advisory describing a plain-text storage of sensitive information vulnerability in their HddPasswordPei driver.

HPE Advisory #1 - HPE published an advisory describing two vulnerabilities in their OneView Global Dashboard.

PulseSecure Advisory - PulseSecure published an advisory describing an integer overflow or wrap around vulnerability in multiple product lines.

QNAP Advisory - QNAP published an advisory describing two cross-site scripting vulnerabilities in their NAS running Proxy Server.

Siemens Advisory - Siemens published an advisory discussing 23 vulnerabilities in their Industrial Products.

VMware Advisory - VMware published an advisory describing a cross-site scripting vulnerability in their Workspace ONE Boxer.

Aruba Update - Aruba published an update for their PwnKit advisory that was originally published on February 1^st, 2022.

Dell Update - Dell published an update for their generic Log4Shell  advisory.

HPE Update - HPE published an update for their PwnKit advisory that was originally published on February 1^st 2022.

Johnson Controls Update - Johnson Controls published an update for their Log4Shell advisory.

Milestone Update - Milestone published an update for their Log4Shell advisory.

WECON Reports - The Zero Day Initiative published 15 reports of vulnerabilities in the WECON LeviStudioU.

Fuji Reports - ZDI published 3 reports of vulnerabilities in the Fuji Electric Alpha5 servo amplifiers.

ICL Report - Zero Science published a report describing a file write/overwrite and delete vulnerability in the ICL ScadaFlex II SCADA Controllers SC-1/SC-2.

ICL Exploit - LiquidWorm published an exploit for the ICL vulnerability reported above.

WebHMI Exploit #1 - Antonio Cuomo published an exploit for a remote code execution vulnerability in WebHMI version 4.1.1.

WebHMI Exploit #2 - Antonio Cuomo published an exploit for cross-site scripting vulnerability in WebHMI 4.1.

 

For more details about these disclosures, including links to 3rd party advisories, researcher reports, and exploits – see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-2-762 - subscription required.

Review - Public ICS Disclosures – Week of 1-29-22 – Part 2

For Part 2 we have four more vendor disclosures from QNAP, TI, VMware, and Fujitsu. We also have five updates from Boston Scientific, Dell, Hillrom, Johnson Controls, and QNAP. There are also 98 researcher reports for vulnerabilities in products from Gerbv (2), and Bentley (96). Finally, we have three exploit reports for products from Moxa (2), and WAGO.

QNAP Advisory - QNAP published an advisory discussing the Deadbolt Ransomware attacks.

TI Advisory - TI published an advisory discussing physical security attacks on ‘silicon devices.’

VMware Advisory - VMware published an advisory describing an information disclosure vulnerability in their VMware Cloud Foundation.

Fujitsu Advisory - Fujitsu published an advisory discussing 15 vulnerabilities in Insyde® Firmware.

Boston Scientific Update - Boston Scientific published an update for their Log4Shell  advisory.

Dell Update - Dell published an update for their generic Log4Shell advisory.

Hillrom Update - Hillrom published an update for their Log4Shell advisory.

Johnson Controls Update - Johnson Controls published an update for their Log4Shell advisory.

QNAP Update - QNAP published an update for their QTS and QuTS hero advisory that was originally published on January 13^th, 2021 and most recently updated on January 25^th, 2022.

Gerbv Reports - Talos published two reports of vulnerabilities in the Gerbv RS-274X viewer.

Bentley Reports - The Zero Day Initiative published 96 reports (ZDI-22-149 thru ZDI-22-243ZDI) about vulnerabilities in the Bentley MicroStation and MicroStation-based applications.

Moxa Exploit #1 - Matthew Bergin published an exploit for a firmware upgrade vulnerability in the Moxa TN-5900.  

Moxa Exploit #2 - Matthew Bergin published an exploit for a command injection vulnerability vulnerability in the Moxa TN-5900.  

WAGO Exploit - Gerhard Hechenberger published an exploit for an improper handling of exceptional conditions vulnerability in the WAGO 750-8xxx PLC.

NOTE: This was reported as a third-party (CODESYS) vulnerability, so this exploit may work (with or without modification?) on other vendor products.

 

For more details on these disclosures, including links to 3rd party advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1-d73 - subscription required.

Review - Public ICS Disclosure – Week of 1-8-22 – Part 1

This week, as we have come to expect for the Saturday after 2^nd Tuesday, we have a full slate of ICS disclosures, including more Log4Shell disclosures, that will take multiple posts to deal with. In Part 1 we have fourteen vendor disclosures from Belden, Blackberry, Dynalite, Hitachi Energy, HPE, Moxa, Palo Alto Networks (4), QNAP (3), and Yokogawa. There is also an update from HPE. There were also two researcher reports for products from IDEMIA and ODA. Finally, we have an exploit for products from SonicWall.

Part 2 of this post will address the Schneider advisories and updates that were published on Tuesday as well as the Siemens updates that were not addressed by NCCIC-ICS this week.

Belden Advisory - Belden published an advisory describing six vulnerabilities in their Tofino and Eagle products.

BlackBerry Advisory - BlackBerry published an advisory describing an elevation of privilege vulnerability in their QNX Neutrino Kernel.

Dynalite Advisory - Dynalite published an advisory discussing two vulnerabilities in their DDNG-BACnet gateway and in Niagara SOFTJACE products.

Hitachi Energy Advisory - Hitachi Energy published an advisory discussing four vulnerabilities in their e-mesh™ Energy Management System (EMS) Product.

HPE Advisory HPE published an advisory describing a remote access vulnerability in their Ezmeral Data Fabric.

Moxa Advisory - Moxa published an advisory describing four vulnerabilities in their VPort 06EC-2V Series and VPort 461A Series IP Cameras and Video Servers.

Palo Alto Advisory #1 - Palo Alto published an advisory describes an uncontrolled search path element vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #2 - Palo Alto published an advisory describes an untrusted search path element vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #3 - Palo Alto published an advisory describing a link following vulnerability in their Cortex XDR Agent.

Palo Alto Advisory #4 - Palo Alto published an advisory describing a file and directory information exposure vulnerability in their Cortex XDR Agent.

Phoenix Contact Advisory - Phoenix Contact published an advisory discussing the NUCLEUS:13 vulnerabilities in their BLUEMARK X1 / LED / CLED printers.

QNAP Advisory #1 - QNAP published an advisory describing a remote code execution vulnerability in their QTS and QuTS hero products.

QNAP Advisory #2 - QNAP published an advisory describing five separate classic buffer overflow vulnerabilities in their QVR Elite, QVR Pro, and QVR Guard products.

QNAP Advisory #3 - QNAP published an advisor describing two vulnerabilities in their QcalAgent.

Yokogawa Advisor - Yokogawa published an advisory discussing a link following vulnerability in the license function in Yokogawa products.

HPE Update - HPE published an update for their Integrated Lights-out 4 advisory that was originally published  on August 23^rd, 2017.

IDEMIA Report - Positive Technologies published a report of a TLS bypass vulnerability in biometric identification vulnerabilities in products from IDEMIA.

ODA Report - ZDI published a report describing a JPG File Parsing Memory Corruption in the Open Design Alliance (ODA) Drawings Explorer.

SonicWall Exploit - jbaines-r7 published Metasploit module for a command injection vulnerability in the SonicWall SMA 100 Series.

For more details on the above disclosures, including links to 3^rd party advisories and vulnerability exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-1-8 - subscription required.

Review - Public ICS Disclosures – Week of 1-1-22 – Part 1

This was a relatively light week for ICS disclosures, but because of the continuing response to the  Log4Shell vulnerabilities, this will be a two part report.

This week we have ten vendor disclosures from Draeger, Hitachi, Kunbus, Moxa (2), QNAP (2), Texas Instruments, VMware, and Yokogawa. There was an update for an advisory for products from IDEC. There are also nine researcher reports for products from Siemens (8) and VMware. Finally, we have one exploit published for products from Siemens.

Draeger Advisory - Drager published an advisory discusses the use of the out-of-support TLS 1.0 and TLS 1.1.

Hitachi Advisory - Hitachi published an advisory discussing 27 vulnerabilities in their Disc Array Systems.

Kunbus Advisory - Kunbus published an advisory describing two vulnerabilities in their Revolution Pi base modules.

Moxa Advisory #1 - Moxa published an advisory discussing the DNSpooq vulnerabilities in their AWK-3131A/4131A/1137C/1131A Series of products.

Moxa Advisory #2 - Moxa published an advisory describing a memory leak vulnerability in their EDR-G903, EDR-G902, and EDR-810 Series Secure Routers.

QNAP Advisory #1 - QNAP published an advisory describing a code execution vulnerability in their NAS running QVPN Service product.

QNAP Advisory #2 - QNAP published an advisory describing cross-site scripting vulnerability in their TFTP Server.

TI Advisory - TI published an advisory discussing the BrakTooth vulnerabilities in their dual-mode Bluetooth products.

VMware Advisory - VMware published an advisory describing a heap overflow vulnerability in their Workstation, Fusion and ESXi products.

Yokogawa Advisory - Yokogawa published an advisory describing seven vulnerabilities in their CENTUM and Exaopc products.

IDEC Update - JPCERT published an update for their IDEC PLC advisory that was originally published on December 24^th, 2021.

Siemens Reports - The Zero Day Initiative published eight reports about vulnerabilities in the Siemens JT2Go products.

VMware Report - USD HeroLab published a report describing a hidden functionality vulnerability in the VMware Workspace ONE Intelligent Hub.

Siemens Exploit - RoseSecurity published an exploit for a denial of service vulnerability in the Siemens S7 Layer 2 product.

For more details about these disclosures, including links to 3^rd party advisories, see my article at CFSN Detailed analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-1 - subscription required.

Review - Public ICS Disclosure – Week of 12-18-21 – Part 1

Merry Christmas. This has been another busy week for ICS disclosures. Part 1 today will be normal vulnerabilities and Part 2 (probably tomorrow) will be Log4Shell disclosures.

This week we have six vendor disclosures from ABB, IDEC Corporation, QNAP, Hitachi Energy (2), and Johnson Controls. We also have twelve researcher reports for products from Garrett (7) and Open Design Alliance (5).

ABB Advisory - ABB published an advisory describing an MMS file transfer vulnerability in their Distribution Automation products.

IDEC Advisory - JPCERT published an advisory [link added 18:40 EST 1-6-22] for four vulnerabilities in the IDEC PLCs.

QNAP Advisory - JPCERT published an advisory describing two vulnerabilities in the QNAP VioStar series NVR.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory describing four vulnerabilities in their LinkOne product.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisor discussing seven vulnerabilities in their Data Manager (SDM600) product.

Johnson Controls Advisory - Johnson Controls published an advisory describing an unspecified vulnerability in their American Dynamics VideoEdge NVR.

NOTE: It looks like this has been reported to NCCIC-ICS, so we may see an advisory from them next week

Garrett Reports - Talos published seven reports covering nine vulnerabilities in the Garrett Metal Detectors used for security screening.

ODA Reports - The Zero Day Initiative published five reports covering vulnerabilities in the ODA Drawings Explorer product.

For more details on these advisories, including links to third-party advisories, see my report at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-12 - subscription required.

Review - Public ICS Disclosures – Week of 11-13-21 – Part 2

For Part 2 we have six vendor disclosures from Flexera, HPE, Meinberg, QNAP, Tanzu, and VMware. There as an update from CODESYS. We also have six researcher reports about vulnerabilities in products from LibreCad (3) and Open Design Alliance (3).

Flexera Advisory - Flexera published an advisory describing an open redirect vulnerability in their FlexNet Publisher.

HPE Advisory - HPE published an advisory discussing four vulnerabilities in their Fibre Channel Host Bus Adapters.

Meinberg Advisory - Meinberg published an advisory describing six vulnerabilities in their LANTIME-Firmware.

QNAP Advisory - QNAP published an advisory describing a cross-site scripting vulnerability in their NAS running Ragic Cloud DB.

Tanzu Advisory - Tanzu published an advisory describing a code injection vulnerability in their Spring Cloud Netflix Hystrix Dashboard.

VMware Advisory - VMware published an advisory describing a privilege escalation vulnerability in their VMware Center Server.

CODESYS Update - CODESYS published an update for their Gateway V3 advisory that was originally published on March 29^th, 2021  and most recently updated on May 18^th, 2021.

LibreCad Report #1 – Talos published a report describing a use after free vulnerability in the LibreCad libdxfrw. This is a coordinated disclosure.

LibreCad Report #2 - Talos published a report describing an improper restriction of operations within the bounds of a memory buffer in the LibreCad libdxfrw.

LibreCad Report #3 - Talos published a report describing an out-of-bounds write vulnerability in the LibreCad libdxfrw.

ODA Report #1 - ZDI published a report describing a use-after-free vulnerability in the ODA ODAviewer product.

ODA Report #2 - ZDI published a report describing an out-of-bounds read vulnerability in the ODA ODAviewer product.

ODA Report #3 - ZDI published a report describing an out-of-bounds read vulnerability in the ODA ODAviewer product.

For more details about these advisories and reports, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-e7c - subscription required.

Review - 1 Advisory Published – 10-26-21

Today, CISA’s NCCIC-ICS published a control system security advisory for products from Fuji Electric.

Fuji Advisory - This advisory describes six vulnerabilities in the Fuji Tellus Lite V-Simulator, and V-Server Lite products.

For more details about the advisory, including my discussion about how 20 vulnerabilities reported by kimiya via the Zero Day Initiative became 6 vulnerabilities in today’s advisory, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-published-10-26-21 - subscription required. [Link added - 10-26-21, 22:50 EDT]

Review - Public ICS Disclosures – Week of 10-9-21 – Part 1

This week we have nine vendor disclosures from Aruba Networks, Braun, DrayTek, Omron, Hitachi, SonicWall, and VMware (3). We also have an update from Yokogawa. Finally, there are four researcher reports for products from Fuji Electric.

Aruba Advisory - Aruba published an advisory describing 18 vulnerabilities in their ClearPass Policy Manager product.

Braun Advisory - Braun published an advisory discussing the Ripple20 vulnerabilities.

DrayTek Advisory - DrayTek published an advisory describing two vulnerabilities in their VigorConnect software.

Omron Advisory - JPCERT published an advisory describing an out-of-bounds read vulnerability in the Omron CX-Supervisor.

Hitachi Advisory - Hitachi published an advisory discussing 30 vulnerabilities in their Disk Array Systems.

SonicWall Advisory - SonicWall published an advisory describing a host header redirection vulnerability in their SonicOS product.

VMware Advisory #1 - VMware published an advisory describing a server side request forgery in their vRealize Operations products.

VMware Advisory #2 - VMware published an advisory describing a CSV injection vulnerability in their vRealize Log Insight product.

VMware Advisory #3 - VMware published an advisory describing an open redirect vulnerability in their vRealize Orchestrator product.

Yokogawa Update - Yokogawa published an update for their Ripple20 advisory that was originally published on May 31^st, 2021.

Fuji Reports - The Zero Day Initiative published four reports of 0-day vulnerabilities in the Alpha5 Servo Operator product from Fuji Electric.

For more details on this disclosures, including links to 3^rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-10-61d - subscription required.