Bulletins | CERT@VDE

SSA-640732 V1.0: Authentication Bypass Vulnerability in Siveillance Video Mobile Server

Titel

SSA-640732 V1.0: Authentication Bypass Vulnerability in Siveillance Video Mobile Server

Veröffentlicht

21. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-640732.pdf

Text

The mobile server component of Siveillance Video 2022 R2 contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to access the application without a valid account. Siemens has released a hotfix for Siveillance Video 2022 R2 and recommends to apply the hotfix on all installations of the ...

20.10.2022

Bentley Systems MicroStation Connect

Titel

Bentley Systems MicroStation Connect

Veröffentlicht

20. Oktober 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-293-01

Text

20.10.2022

B. Braun Infusomat Space Large Volume Pump (Update A)

Titel

B. Braun Infusomat Space Large Volume Pump (Update A)

Veröffentlicht

20. Oktober 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-294-01

Text

This advisory contains mitigation for Unrestricted Upload of File with Dangerous Type, Cleartext Transmission of Sensitive Information, Missing Authentication for Critical Function, Insufficient Verification of Data Authenticity, and Improper Input Validation vulnerabilities in the B. Braun Infusomat Space Large Volume Pump.

19.10.2022

BOSCH PSIRT

CVE-2021-3772 Linux Kernel Vulnerability in NetApp DSA E2800 series

Titel

CVE-2021-3772 Linux Kernel Vulnerability in NetApp DSA E2800 series

Veröffentlicht

19. Oktober 2022 02:00

URL

https://psirt.bosch.com/security-advisories/bosch-sa-609377-bt.html

Text

BOSCH-SA-609377-BT: The Bosch DSA E2800 products are based on NetApp technology, which incorporate a Linux Kernel. Linux Kernel versions prior to 5.15.0 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or Denial of Service (DoS). Successful exploitation of this vulnerability could ...

19.10.2022

BOSCH PSIRT

Multiple Cross Site Scripting vulnerabilities in Bosch VIDEOJET multi 4000

Titel

Multiple Cross Site Scripting vulnerabilities in Bosch VIDEOJET multi 4000

Veröffentlicht

19. Oktober 2022 02:00

URL

https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html

Text

BOSCH-SA-454166-BT: The possibility for a reflected Cross Site Scripting (XSS) and stored Cross Site Scripting (XSS) attack was discovered in the Bosch VIDEOJET multi 4000.For more details please see the description of the vulnerability in this advisory.Bosch rates this vulnerability with CVSSv3.1 base score 5.8 (medium) and 5.1 (medium), where ...

Siemens Industrial Edge Management

Titel

Siemens Industrial Edge Management

Veröffentlicht

13. Oktober 2022 16:46

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-02

Text

Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service

Titel

Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service

Veröffentlicht

13. Oktober 2022 16:40

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-05

Text

This advisory contains mitigations for Allocation of Resources Without Limits or Throttling and Code Injection vulnerabilities in versions of Hitachi Energy Lumada Asset Performance Manager (APM) software.

Siemens Desigo PXM Devices

Titel

Siemens Desigo PXM Devices

Veröffentlicht

13. Oktober 2022 16:38

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-06

Text

Siemens Nucleus RTOS FTP Server

Titel

Siemens Nucleus RTOS FTP Server

Veröffentlicht

13. Oktober 2022 16:36

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-07

Text

Siemens TCP Event Service of SCALANCE And RUGGEDCOM Devices

Titel

Siemens TCP Event Service of SCALANCE And RUGGEDCOM Devices

Veröffentlicht

13. Oktober 2022 16:34

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-08

Text

Siemens SICAM P850 and P855 Devices

Titel

Siemens SICAM P850 and P855 Devices

Veröffentlicht

13. Oktober 2022 16:32

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-09

Text

Altair HyperView Player

Titel

Altair HyperView Player

Veröffentlicht

11. Oktober 2022 16:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-284-01

Text

Daikin Holdings Singapore Pte Ltd. SVMPC1 and SVMPC2

Titel

Daikin Holdings Singapore Pte Ltd. SVMPC1 and SVMPC2

Veröffentlicht

11. Oktober 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-284-02

Text

SSB-898115 V1.0: Remarks Regarding SSA-568427 (Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families)

Titel

SSB-898115 V1.0: Remarks Regarding SSA-568427 (Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families)

Veröffentlicht

11. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssb-898115.pdf

Text

SSA-254054 V1.3 (Last Update: 2022-10-11): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impac...

Titel

SSA-254054 V1.3 (Last Update: 2022-10-11): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products

Veröffentlicht

11. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf

Text

A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as “Spring4Shell” or “SpringShell”. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-568427 V1.0: Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families

Titel

SSA-568427 V1.0: Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families

Veröffentlicht

11. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-568427.pdf

Text

SIMATIC S7-1200, S7-1500 CPUs and related products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private ...

SSA-955858 V1.0: Multiple Vulnerabilities in LOGO! 8 BM Devices

Titel

SSA-955858 V1.0: Multiple Vulnerabilities in LOGO! 8 BM Devices

Veröffentlicht

11. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-955858.pdf

Text

LOGO! 8 BM (incl. SIPLUS variants) contains multiple web-related vulnerabilities. These could allow an attacker to execute code remotely, put the device into a denial of service state or retrieve parts of the memory. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not ...

SSA-935500 V1.0: Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products

Titel

SSA-935500 V1.0: Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products

Veröffentlicht

11. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-935500.pdf

Text

A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/html/ssa-313313.html. The products listed below use affected versions of the Nucleus software and inherently contain the vulnerability. Siemens recommends specific countermeasures for products where updates are not, ...

SSA-280624 V1.1 (Last Update: 2022-10-11): Multiple Vulnerabilities in SCALANCE W1750D

Titel

SSA-280624 V1.1 (Last Update: 2022-10-11): Multiple Vulnerabilities in SCALANCE W1750D

Veröffentlicht

11. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf

Text

The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit multiple buffer overflow vulnerabilities that could lead to denial of service or unauthenticated remote code execution. Siemens has released updates for the SCALANCE W1750D and recommends to update to the latest version. Siemens ...

SSA-384224 V1.0: Denial of Service Vulnerability in SIMATIC HMI Panels

Titel

SSA-384224 V1.0: Denial of Service Vulnerability in SIMATIC HMI Panels

Veröffentlicht

11. Oktober 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-384224.pdf

Text

Several SIMATIC HMI Panels are affected by a vulnerability that could allow an attacker to cause a permanent denial of service condition (requiring a device reboot) by sending specially crafted TCP packets. Siemens has released updates for the affected products and recommends to update to the latest versions.