Bulletins | CERT@VDE

TEM Opera Plus FM Family Transmitter

Titel

TEM Opera Plus FM Family Transmitter

Veröffentlicht

3. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: TEM Equipment: Opera Plus FM Family Transmitter Vulnerabilities: Missing Authentication for Critical Function, Cross-Site Request Forgery (CSRF) 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform remote code ...

02.10.2024

BOSCH PSIRT

Multiple vulnerabilites in libexpat affecting PRC7000

Titel

Multiple vulnerabilites in libexpat affecting PRC7000

Veröffentlicht

2. Oktober 2024 02:00

URL

https://psirt.bosch.com/security-advisories/bosch-sa-200802.html

Text

BOSCH-SA-200802: Multiple vulnerabilities were discovered in the open source library \"libexpat\", affecting the XML parser functionality. These vulnerabilities allow for integer overflows and invalid negative values for buffer sizes. As this may affect the \"Import\" and \"Restore\" functionality - which use libexpat to parse XML files - of the device, ...

01.10.2024

Mitsubishi Electric MELSEC iQ-F FX5-OPC

Titel

Mitsubishi Electric MELSEC iQ-F FX5-OPC

Veröffentlicht

1. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F FX5-OPC Vulnerability: NULL Pointer Dereference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to cause a Denial-of-Service (DoS) condition on the product by getting a legitimate ...

01.10.2024

Optigo Networks ONS-S8 Spectra Aggregation Switch

Titel

Optigo Networks ONS-S8 Spectra Aggregation Switch

Veröffentlicht

1. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Optigo Networks Equipment: ONS-S8 - Spectra Aggregation Switch Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), Weak Authentication 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...

01.10.2024

BOSCH PSIRT

Sensitive information disclosure in Bosch Configuration Manager

Titel

Sensitive information disclosure in Bosch Configuration Manager

Veröffentlicht

1. Oktober 2024 02:00

URL

https://psirt.bosch.com/security-advisories/bosch-sa-981803-bt.html

Text

BOSCH-SA-981803-BT: A vulnerability was discovered during internal testing of the Bosch Configuration Manager, which may temporarily store sensitive information of the configured system.

September 2024

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01

Advantech ADAM-5550

Titel

Advantech ADAM-5550

Veröffentlicht

26. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: Advantech Equipment: ADAM-5550 Vulnerabilities: Weak Encoding for Password, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote attacker to intercept the easily decodable credentials of a legitimate user to gain full access ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02

Advantech ADAM-5630

Titel

Advantech ADAM-5630

Veröffentlicht

26. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Advantech Equipment: ADAM-5630 Vulnerabilities: Use of Persistent Cookies Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to hijack a legitimate user's session, perform cross-site request forgery, or cause a denial-of-service ...

goTenna Pro X and Pro X2

Titel

goTenna Pro X and Pro X2

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro series Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Improper Restriction of Communication Channel to Intended Endpoints, Use of Cryptographically Weak Pseudo-Random Number ...

Atelmo Atemio AM 520 HD Full HD Satellite Receiver

Titel

Atelmo Atemio AM 520 HD Full HD Satellite Receiver

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Atelmo Equipment: Atemio AM 520 HD Full HD Satellite Receiver Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized attacker to execute system commands with elevated ...

goTenna Pro ATAK Plugin

Titel

goTenna Pro ATAK Plugin

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro ATAK Plugin Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Weak Authentication, Insertion of Sensitive ...

OMNTEC Proteus Tank Monitoring

Titel

OMNTEC Proteus Tank Monitoring

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OMNTEC Mfg., Inc. Equipment: Proteus Tank Monitoring Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform administrative actions without proper authentication. 3. TECHNICAL DETAILS 3.1 ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-02

Alisonic Sibylla

Titel

Alisonic Sibylla

Veröffentlicht

24. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Alisonic Equipment: Sibylla Vulnerability: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker obtaining device information from the database, dumping ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-05

Moxa MXview One

Titel

Moxa MXview One

Veröffentlicht

24. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Moxa Equipment: MXview One, MXview One Central Manager Series Vulnerabilities: Cleartext Storage In A File or On Disk, Path Traversal, Time-of-Check Time-of-Use Race Condition 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker ...

Franklin Fueling Systems TS-550 EVO

Titel

Franklin Fueling Systems TS-550 EVO

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Franklin Fueling Systems Equipment: TS-550 EVO Automatic Tank Gauge Vulnerability: Absolute Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability allow an attacker to gain administrative access over the affected device. 3. TECHNICAL DETAILS 3.1 ...

OPW Fuel Management Systems SiteSentinel

Titel

OPW Fuel Management Systems SiteSentinel

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OPW Fuel Managements Systems Equipment: SiteSentinel Vulnerability: Missing Authentication For Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass authentication and obtain full administrative privileges to the server. 3. ...

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE

Titel

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Dover Fueling Solutions (DFS) Equipment: ProGauge MAGLINK LX CONSOLE Vulnerabilities: Command Injection, Improper Privilege Management, Use of Hard-coded Password, Cross-site Scripting, Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of these ...

CISA Adds One Known Exploited Vulnerability to Catalog

US CERT

Titel

CISA Adds One Known Exploited Vulnerability to Catalog

Veröffentlicht

19. September 2024 17:28

URL

https://www.cisa.gov/news-events/alerts/2024/09/19/cisa-adds-one-known-exploited-vulnerability-catalog

Text

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive ...

Kastle Systems Access Control System

Titel

Kastle Systems Access Control System

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Kastle Systems Equipment: Access Control System Vulnerabilities: Use of Hard-coded Credentials, Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information on the affected product. ...

IDEC CORPORATION WindLDR and WindO/I-NV4

Titel

IDEC CORPORATION WindLDR and WindO/I-NV4

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: IDEC Corporation Equipment: WindLDR, WindO/I-NV4 Vulnerability: Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of WindLDR ...

MegaSys Computer Technologies Telenium Online Web Application

Titel

MegaSys Computer Technologies Telenium Online Web Application

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: MegaSys Computer Technologies Equipment: Telenium Online Web Application Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to inject arbitrary Perl code through a crafted HTTP request, leading to ...

Rockwell Automation RSLogix 5 and RSLogix 500

Titel

Rockwell Automation RSLogix 5 and RSLogix 500

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable locally/high attack complexity Vendor: Rockwell Automation Equipment: RSLogix 5 and RSLogix 500 Vulnerability: Insufficient verification of data authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

17.09.2024

Yokogawa Dual-redundant Platform for Computer (PC2CKM)

Titel

Yokogawa Dual-redundant Platform for Computer (PC2CKM)

Veröffentlicht

17. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Yokogawa Equipment: Dual-redundant Platform for Computer (PC2CKM) Vulnerability: Unchecked Return Value 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a denial-of-service. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions ...

17.09.2024

Millbeck Communications Proroute H685t-w

Titel

Millbeck Communications Proroute H685t-w

Veröffentlicht

17. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Millbeck Communications Equipment: Proroute H685t-w Vulnerabilities: Command Injection, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary commands on the device's operating system. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

12.09.2024

Rockwell Automation AADvance Trusted SIS Workstation

Titel

Rockwell Automation AADvance Trusted SIS Workstation

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-20

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: AADvance Trusted SIS Workstation Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker executing code within the context of a current process. 3. TECHNICAL DETAILS 3.1 ...

12.09.2024