Bulletins | CERT@VDE

Siemens Mendix SAML Module

Titel

Siemens Mendix SAML Module

Veröffentlicht

16. Juni 2022 17:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-04

Text

This advisory contains mitigations for Improper Restriction of XML External Entity Reference, and Cross-site Scripting vulnerabilities in the Siemens Mendix SAML Module.

Siemens Apache HTTP Server

Titel

Siemens Apache HTTP Server

Veröffentlicht

16. Juni 2022 16:56

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-06

Text

This advisory contains mitigations for NULL Pointer Dereference, Out-of-bounds Write, and Server-side Request Forgery (SSRF) vulnerabilities in the Siemens Apache HTTP Server.

Siemens SICAM GridEdge

Titel

Siemens SICAM GridEdge

Veröffentlicht

16. Juni 2022 16:52

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-08

Text

This advisory contains mitigations for Missing Authentication for Critical Function, and Resource Leak vulnerabilities in the Siemens SICAM GridEdge Essential ARM.

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Titel

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Veröffentlicht

16. Juni 2022 16:50

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-09

Text

This advisory contains mitigations for vulnerabilities in the Siemens SCALANCE LPE9403, a processing power extension for the SCALANCE family of products.

Siemens SCALANCE XM-400 and XR-500

Titel

Siemens SCALANCE XM-400 and XR-500

Veröffentlicht

16. Juni 2022 16:48

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-10

Text

This advisory contains mitigations for an Improper Validation of Integrity Check Value vulnerability in the Siemens SCALANCE XM-400 and XR-500 industrial switches.

Siemens Xpedition Designer

Titel

Siemens Xpedition Designer

Veröffentlicht

16. Juni 2022 16:46

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-11

Text

This advisory contains mitigations for an Incorrect Permission Assignment for Critical Resource vulnerability in the Siemens Xpedition Designer PCB design flow products.

Siemens Spectrum Power Systems

Titel

Siemens Spectrum Power Systems

Veröffentlicht

16. Juni 2022 16:44

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-12

Text

This advisory contains mitigations for a Use of Hard-coded Credentials vulnerability in the Siemens Spectrum Power data modelling and monitoring system.

Siemens OpenSSL Affected Industrial Products

Titel

Siemens OpenSSL Affected Industrial Products

Veröffentlicht

16. Juni 2022 16:40

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-14

Text

This advisory contains mitigations for an Infinite Loop vulnerability in the Siemens OpenSSL Affected Industrial Products.

Johnson Controls Metasys ADS ADX OAS Servers

Titel

Johnson Controls Metasys ADS ADX OAS Servers

Veröffentlicht

14. Juni 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-165-01

Text

This advisory contains mitigations for Unverified Password Change, and Cross-site Scripting vulnerabilities in the Johnson Controls Metasys ADS ADX OAS Servers.

Meridian Cooperative Meridian

Titel

Meridian Cooperative Meridian

Veröffentlicht

14. Juni 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-165-02

Text

This advisory contains mitigations for an Improper Access Control vulnerability in Meridian utility software.

Mitsubishi Electric MELSEC-Q/L and MELSEC iQ-R

Titel

Mitsubishi Electric MELSEC-Q/L and MELSEC iQ-R

Veröffentlicht

14. Juni 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-165-03

Text

This advisory contains mitigations for an Improper Input Validation vulnerability in the Mitsubishi Electric MELSEC-Q/L Series and MELSEC iQ-R Series Interface Modules.

SSA-480230 V2.3 (Last Update: 2022-06-14): Denial of service in Webserver of Industrial Products

Titel

SSA-480230 V2.3 (Last Update: 2022-06-14): Denial of service in Webserver of Industrial Products

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf

Text

A vulnerability in the affected devices could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial of service attack. Siemens has released updates for several affected products and recommends to update to the new versions. Siemens is preparing further updates and ...

SSA-592007 V1.7 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in Industrial Products

Titel

SSA-592007 V1.7 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in Industrial Products

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-592007.pdf

Text

Several industrial controllers are affected by a security vulnerability that could allow an attacker to cause a Denial-of-Service condition via PROFINET DCP network packets under certain circumstances. Precondition for this scenario is a direct OSI Layer 2 access to the affected products. PROFIBUS interfaces are not affected. Siemens has released ...

SSA-780073 V2.2 (Last Update: 2022-06-14): Denial of Service Vulnerability in PROFINET Devices via DCE-RPC Packets

Titel

SSA-780073 V2.2 (Last Update: 2022-06-14): Denial of Service Vulnerability in PROFINET Devices via DCE-RPC Packets

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-780073.pdf

Text

Products that include the Siemens PROFINET-IO (PNIO) stack in versions prior V06.00 are potentially affected by a denial of service vulnerability when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. Siemens has released updates for several affected products and recommends to update to the new versions. Siemens ...

SSA-626968 V1.1 (Last Update: 2022-06-14): Multiple Webserver Vulnerabilities in Desigo PXC and DXR Devices

Titel

SSA-626968 V1.1 (Last Update: 2022-06-14): Multiple Webserver Vulnerabilities in Desigo PXC and DXR Devices

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf

Text

Desigo PXC3, PXC4, PXC5 and DXR2 devices contain multiple vulnerabilities in the webserver application that could allow an attacker to potentially intercept unencrypted transmission of sensitive information, cause a denial of service condition, or perform remote code execution. Siemens has released updates for the affected products and recommends to update ...

SSA-593272 V1.7 (Last Update: 2022-06-14): SegmentSmack in Interniche IP-Stack based Industrial Devices

Titel

SSA-593272 V1.7 (Last Update: 2022-06-14): SegmentSmack in Interniche IP-Stack based Industrial Devices

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-593272.pdf

Text

A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released updates for several ...

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Titel

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf

Text

Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or PAR) with any of the affected products, this could lead the application to crash or potentially lead to ...

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Titel

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-220589.pdf

Text

Siemens has released updates for Teamcenter that fixes a security vulnerability related to unsecure storage of user credentials. This vulnerability affects Java EE Server Manager HTML Adaptor. This service is not installed by default and currently also obsoleted. Siemens has released updates for the affected products and recommends to update ...

SSA-693555 V1.0: Memory Corruption Vulnerability in EN100 Ethernet Module

Titel

SSA-693555 V1.0: Memory Corruption Vulnerability in EN100 Ethernet Module

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf

Text

EN100 Ethernet module is affected by memory corruption vulnerability (CVE-2022-30937). Siemens has released an update for the EN100 Ethernet module IEC 61850 variant and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

SSA-145224 V1.0: Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices

Titel

SSA-145224 V1.0: Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-145224.pdf

Text

SCALANCE XM-400 and XR-500 devices contain a vulnerability in the OSPF protocol implementation that could allow an unauthenticated remote attacker to cause interruptions in the network. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-222547 V1.0: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0

Titel

SSA-222547 V1.0: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf

Text

Multiple vulnerabilities in the third-party components CivetWeb, Docker, Linux Kernel and systemd could allow an attacker to impact SCALANCE LPE9403 confidentiality, integrity and availability. Siemens has released an update for the SCALANCE LPE9403 and recommends to update to the latest version.

SSA-732250 V1.1 (Last Update: 2022-06-14): Libcurl Vulnerabilities in Industrial Devices

Titel

SSA-732250 V1.1 (Last Update: 2022-06-14): Libcurl Vulnerabilities in Industrial Devices

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf

Text

Vulnerabilities in third-party component cURL could allow an attacker to interfere with the affected products in various ways. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not ...

SSA-549234 V1.2 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in SIMATIC NET CP Modules

Titel

SSA-549234 V1.2 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in SIMATIC NET CP Modules

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-549234.pdf

Text

A denial of service vulnerability was identified in different types of Communication Processors. An attacker could exploit this vulnerability causing the device to become un-operational until the device is restarted. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Titel

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf

Text

The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit’s pkexec utility, that could allow an unprivileged user to gain administrative rights. Siemens has released updates for the affected products and recommends to update to the latest versions.