Review – 2 Advisories and 1 Update Published – 8-11-26

Today CISA’s NCCIC-ICS published two medical device security advisories for products from Mira and Pulsetto. They also updated a control system security advisory for products from Johnson Controls. 

Advisories  

Mira Advisory - This advisory describes eight vulnerabilities in the (Quanovate Tech) Mira Hormone Monitor and Mira Android App. 

Pulsetto Advisory - This advisory describes a hidden functionality vulnerability in the Pulsetto Vagus Nerve Stimulator. 

Updates 

Johnson Controls Update - This update provides addition information on the C-CURE 9000 advisory that was originally published on July 23rd, 2026 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-and-1-update-published-4db - subscription required. 

Review – 7 Advisories Published – 7-23-26

 Today, CISA’s NCCIC-ICS published seven control system security advisories for products from MZ Automation (2), Rockwell, Panduit, Weintek, and Johnson Controls (2). 

Advisories  

MZ Automation Advisory #1 - This advisory describes an out-of-bound read vulnerability in the MZ Automation lib60870. 

MZ Automation Advisory #2 - This advisory describes four vulnerabilities in the MZ Automation libIEC61850. 

Rockwell Advisory - This advisory describes a path traversal vulnerability in the Rockwell Automation ThinManager, 

Panduit Advisory - This advisory describes five vulnerabilities in the Panduit IntraVUE. 

Weintek Advisory - This advisory describes four vulnerabilities in the Weintek cMT3092X HMI. 

Johnson Controls Advisory #1 - This advisory describes a clear text storage of sensitive information vulnerability in the Johnson Controls XAAP Android system inspection application. 

Johnson Controls Advisory #2 - This advisory describes three vulnerabilities in the Johnson Controls C-CURE 9000 and Victor application server. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-published-7-23-26 - subscription required. 

Review – 2 Advisories and 1Update Published – 7-17-25

Today CISA’s NCCIC-ICS published a control system security advisory for products from Leviton and a medical device security advisory for products from Panoramic Corp. There is an update for a previously released control system advisory for products from Johnson Controls.

Advisories

Leviton Advisory - This advisory describes a cross-site scripting vulnerability in the Leviton AcquiSuite and Energy Monitoring Hub products.

Panoramic Advisory - This advisory discusses an uncontrolled search path element vulnerability (with a publicly available exploit) in the Panoramic (dental) Digital Imaging Software.

Updates

Johnson Controls Update - This update provides additional information on the C●CURE 9000 advisory that was originally published on July 9^th, 2024, and most recently updated on January 16^th, 2025.

 

For more information on these advisories, including links to researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2-advisories-and-1update-published - subscription required.

Review – 8 Advisories and 4 Updates Published 1-16-25

Today CISA’s NCCIC-ICS published eight control system security advisories for product from Schneider Electric, Hitachi Energy (2), Fuji Electric, and Siemens (4). They also updated advisories for products from Mitsubishi (2), Johnson Controls, and Delta Electronics.

Advisories

Schneider Advisory - This advisory describes two vulnerabilities in the Schneider Data Center Expert.

Hitachi Energy Advisory #1 - This advisory describes a relative path traversal advisory in the Hitachi Energy FOX61x Products.

Hitachi Energy Advisory #2 - This advisory describes an improper validation of certificate with host mismatch vulnerability in the Hitachi Energy FOX61x, FOXCST, and FOXMAN-UN products.

Fuji Advisory - This advisory describes a stack-based buffer overflow vulnerability in the Fuji Alpha5 SMART servo drive system.

Siemens Advisory #1 - This advisory describes a files or directories accessible to external parties vulnerability in the Siemens SIPROTEC 5 products.

Siemens Advisory #2 - This advisory discusses an insertion of sensitive information into a log file vulnerability in the Siemens Siveillance Video Device Pack.

Siemens Advisory #3 - This advisory describes a cross-site scripting vulnerability in the Siemens Industrial Edge Management.

Siemens Advisory #4 - This advisory describes an LDAP injection vulnerability in the Siemens Mendix LDAP. The vulnerability was self-reported.

Updates

Mitsubishi Update #1 - This update provides additional information on the FA Engineering Software products advisory that was originally published on January 30^th, 2024 and most recently updated on October 31^st, 2024.

Mitsubishi Update #2 - This update provides additional information on the Multiple Factory Automation products advisory that was originally published on February 27^th, 2024.

Johnson Controls Update - This update provides additional information on the Software House C●CURE 9000 advisory that was originally published on July 9^th, 2024.

Delta Update - This update provides additional information on the DRASimuCAD advisory that was originally published on January 9^th, 2025.

 

For more information on these advisories , including a link to a third-party advisory and a description of duplicate CISA advisory, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/8-advisories-and-4-updates-published  [link added 11:30 pm EDT 1-16-15] - subscription required.

Review – 5 Advisories and 2 Updates Published

Today, CISA’s NCCIC-ICS published five control system security advisories for products from Johnson Controls (3), Mitsubishi Electric, and Delta Electronics. They also updated advisories for products from Mitsubishi and PTC.

Advisories

Johnson Controls Advisory #1 - This advisory describes an incorrect default permissions vulnerability in the Johnson Controls Software House C●CURE 9000 Site Server.

Johnson Controls Advisory #2 - This advisory describes a use of weak credentials vulnerability in the Johnson Controls Software House C●CURE 9000 Site Server.

Johnson Controls Advisory #3 - This advisory discusses a dependency on vulnerable 3rd party component (JQuery) in the Johnson Controls Illustra Pro Gen 4 Camera.

Mitsubishi Advisory - This advisory describes an incorrect default permissions vulnerability in the Mitsubishi MELIPC Series MI5122-VW industrial PC.

Delta Advisory - This advisory describes four vulnerabilities in the Delta CNCSoft-G2.

Updates

Mitsubishi Update - This update provides additional information for the FA Engineering Software advisory that was originally published on September 26^th, 2023.

PTC Update - This update provides additional information for the PTC Creo Elements advisory that was originally published on June 25^th, 2024.

 

For more information on these advisories, including a down-the-rabbit-hole look at how CWE-1395 can hide the real extent of the 3^rd party vulnerabilities in a system, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-2-updates-published-a8a - subscription required.

Review – 4 Advisories Published – 5-14-24

Today, CISA’s NCCIC-ICS published four control system security advisories for products from Mitsubishi Electric, Johnson Controls, SUBNET, and Rockwell Automation.

Advisories

Mitsubishi Advisory - This advisory describes 12 vulnerabilities in the multiple Mitsubishi FA Engineering software products.

Johnson Controls Advisory - This advisory describes an insertion of sensitive information into log file vulnerability in the Johnson Controls Software House C●CURE 9000 security management system.

SUBNET Advisory - This advisory describes a reliance on insufficiently trustworthy components vulnerability in the SUBNET PowerSYSTEM Center product.

Rockwell Advisory - This advisory describes an unquoted search path vulnerability in the Rockwell Factory Talk Remote Access (FTRA) product.

 

For more details about these advisories, and a brief down-the-rabbit-hole look at simple OPSEC problems, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/4-advisories-published-5-14-24 - subscription required.

Review – 3 Advisories Published – 10-11-22

Today, CISA’s NCCIC-ICS published three controls system security advisories for products from Johnson Controls, Daikin Holdings and Altair.

Johnson Control Advisory - This advisory describes an observable response discrepancy vulnerability in the Johnson Controls C-CURE 9000 security management system.

Daikin Advisory - This advisory describes two vulnerabilities in the Daikin SVMPC1 and SVMPC2 remote controllers.

Altair Advisory - This advisory describes four vulnerabilities in the Altair HyperView Player.

 

For more details about these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-published-10-11-22 - subscription required.

Review - Public ICS Disclosures – Week of 7-31-21

This week we have three INFRA:HALT advisories from: Phoenix Contact, Schneider Electric, Siemens. We have 17 other advisories for products from Aruba, Bosch, Carestream, Genetec, Hitachi ABB Power Grids (3), Johnson Controls, Mitsubishi Electric (4), Phoenix Contact (3), PulseSecure, VMware. Finally, there are two updates from CODESYS and PcVue.

INFRA:HALT Advisories

Phoenix Contact published an advisory discussing the INFRA:HALT vulnerabilities.

Schneider published an advisory discussing the INFRA:HALT vulnerabilities.

Siemens published an advisory discussing the INFRA:HALT vulnerabilities.

Other Advisories

Aruba published an advisory describing a privilege escalation vulnerability in their Analytics and Location Engine (ALE).

Bosch published an advisory describing a cross-site request forgery vulnerability in their IP Cameras.

Carestream published an advisory discussing the PrintNightmare vulnerabilities.

Genetec published an advisory describing four vulnerabilities in their Streamvault products.

Hitachi ABB published an advisory discussing the FragAttacks WiFi vulnerabilities in their TropOS Product.

Hitachi ABB published an advisory describing a password in memory vulnerability in their Counterparty Settlement Billing (CSB) Product.

Hitachi ABB published an advisory describing a password in memory vulnerability in their Retail Operations Product.

Johnson Controls published an advisory describing an auto-update vulnerability in their Software House C•CURE 9000 product

Mitsubishi published an advisory describing an information disclosure vulnerability in their MELSEC iQ-R Series CPU module.

Mitsubishi published an advisory describing an unauthorized log-in vulnerability in their MELSEC iQ-R series CPU modules.

Mitsubishi published an advisory describing a denial-of-service vulnerability in their MELSEC iQ-R Series CPU module.

Mitsubishi published an advisory describing an authentication bypass vulnerability in their MELSEC iQ-R Series CPU Module.

Phoenix Controls published an advisory discussing the WIBU CodeMeter vulnerabilities reported by NCCIC-ICS.

Phoenix Controls published an advisory describing a denial of service vulnerability in their PLCnext Control devices.

Phoenix Controls published an advisory describing an improper privilege management vulnerability in their  FL MGUARD DM product.

PulseSecure published an advisory describing six vulnerabilities in their Pulse Connect Secure.

VMware published an advisory describing two vulnerabilities in their VMware Workspace ONE Access product.

Updates

CODESYS published an update for their CODESYS Development System V3 advisory that was originally published on July 15^th, 2021.

PcVue published an update for their advisory that was originally published in November 2020.

For more details on these advisories, including links to exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-e33 - subscription required.

Review - Six Advisories Published – 7-1-21

Today CISA’s NCCIC-ICS published six control system security Advisories for products from All Bachmann Electronic, Mitsubishi Electric (2), Delta Electronics, and Johnson Controls (2).

Bachmann Advisory - This advisory describes a use of password hash with insufficient computational effort in the Bachmann M-Base Controllers.

Mitsubishi Advisory #1 - This advisory describes an improper restriction of XML external entity reference vulnerability in the Mitsubishi Air Conditioning Systems.

Mitsubishi Advisory #2 - This advisory describes an incorrect implementation of authentication algorithm in the Mitsubishi Air Conditioning Systems.

Delta Advisory - This advisory describes an out-of-bounds read vulnerability in the Delta DOPSoft.

Johnson Controls Advisory #1 - This advisory describes an improper input validation vulnerability in the Johnson Controls C-CURE 9000.

Johnson Controls Advisory #2 - This advisory describes an improper privilege management vulnerability in the Johnson Controls Facility Explorer SNC Series Supervisory Controller.

For a more detailed look at the advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/six-advisories-published - subscription required.

Public ICS Disclosures – Week of 5-23-20

This week we have 11 vendor disclosure for products from SWARCO Traffic Systems, Bosch, ABB (8), and Belden. There are also two updated vendor disclosures from Johnson Controls and Belden.

SWARCO Advisory

INCIBE-CERT published an advisory describing an inadequate access control vulnerability on the SWARCO LS4000 CPU. The vulnerability was reported by Martin Aman, from the company ProtectEM. SWARCO has a patch that mitigates the vulnerability. There is no indication that Aman was provided an opportunity to verify the efficacy of the fix.

Bosch Advisory

Bosch has published an advisory describing four vulnerabilities in their Bosch Recording Station (BRS). The vulnerabilities are apparently self-reported. Bosch provides generic work arounds and recommends a new product upgrade.

The four reported vulnerabilities are:

• EternalBlue - CVE-2017-0144,

• BlueKeep - CVE-2019-0708,

• Improper access control - CVE-2020-6774, and

• Lack of full disc encryption – (no CVE)

ABB Advisories

ABB published eight advisories dealing with the effects of the Urgent/11 vulnerabilities on specific product lines. ABB initially published a series of initial reports on the UGRGENT/11 vulnerabilities back in July of last year and those were referenced in the NCCIC-ICS URGENT/11 advisory. At that time ABB was only able to provide generic workarounds for the vulnerabilities. This week’s advisories provide more specific mitigation measures:

• CI845 – new version,

• FOX615 Multiservice-Multiplexer – new version,

• Relion 670, Relion 650, SAM600-IO series – new versions,

• AFS66x – new version,

• NSD570 Teleprotection Equipment – new versions,

• ETL600 Power Line Carrier System – new version,

• REB500 – new version, and

• RTU500 series – new versions

Belden Advisory

Belden published an advisory describing a buffer overflow vulnerability in the Linux Point-to-Point Protocol (PPP) daemon in the Belden Hirschman OWL devices. This vulnerability is apparently self-reported. Belden has a new version that mitigates the vulnerability.

NOTE: There are a number of proof-of-concept exploits (see here for example) available for this vulnerability.

Johnson Controls Update

Johnson Controls published an update for an advisory that was originally published on May 21^st, 2020. The new information includes:

• Updated affected version information for the C•CURE 9000, and

• More detailed mitigation instructions

Belden Update

Belden published an update for an advisory that was originally published on February 14^th, 2020 and most recently updated on February 26^th, 2020. The new information includes a CVE identifier (with link) for the vulnerability.

Public ICS Disclosures – Week of 11-30-19

This week we have three vendor disclosures for products from BD, GE and Johnson Controls and an URGENT/11 update from Belden. There are also three exploit code reports for products from Fronius, Salto and YachtControl.

BD Advisory

BD published an advisory describing and anti-virus bypass vulnerability in BD products with workstations running CylancePROTECT®. The third-party vulnerability was originally reported by Skylight. BD recommends updating the CylancePROTECT product.

NOTE: I wonder what other ICS vendors bundle CylancePROTECT as a cybersecurity tool? Since the product does not need to do signature updates it would seem to be a tool designed for control system security.

GE Advisory

GE published an advisory describing two privilege escalation vulnerabilities in the GE Digital HMI/SCADA iFIX product. The vulnerability was reported by Applied Risk. GE provides generic mitigation guidance for the vulnerability.

Johnson Controls Advisory

Johnson Controls published an advisory describing vulnerabilities in a third-party component of their Software House C•CURE 9000 application. The vulnerabilities in the Flexera FlexNet Publisher licensing manage have been previously reported. Johnson Controls has an update that mitigates the vulnerability.

Belden Update

Belden published an update of their URGENT/11 advisory that was originally published July 29^th, 2019 and most recently updated on October 30^th, 2019. The new information includes update information for Hirschmann HiOS RSPE TSN.

Fronius Expliot

SEC Consult published a report containing exploit code for four vulnerabilities in the solar inverter series of Fronius. This is reportedly a coordinated disclosure. Fronius has a firmware patch that mitigates the vulnerabilities. There is no indication that SEC Consult has been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Unencrypted communication;

• Authenticated path traversal - CVE-2019-19229;

• Backdoor account - CVE-2019-19228; and

• Outdated and vulnerable software components

NOTE: This is the first time that I have seen an easter-egg included in a vulnerability report.

Salto Exploit

SEC Consult published a report containing exploit code for six vulnerabilities in the Salto ProAccess Space management software for an access control system. This is reportedly a coordinated disclosure. Salto has a patch that mitigates the vulnerabilities. There is no indication that SEC Consult has been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Path traversal - CVE-2019-19458;

• Arbitrary file write - CVE-2019-19459;

• Stored cross-site scripting - CVE-2019-19457;

• Webserver running as Windows Service per default - CVE-2019-19460;

• Authorization issues; and

• Cleartext transmission of sensitive data

Yachtcontrol Exploit

Hodorsec published exploit code for a remote code execution vulnerability in the Yachtcontrol web application. The report includes a CVE number so this may be a coordinated disclosure.