Bulletins | CERT@VDE

AA22-057A: Destructive Malware Targeting Organizations in Ukraine

Titel

AA22-057A: Destructive Malware Targeting Organizations in Ukraine

Veröffentlicht

26. Februar 2022 16:00

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-057a

Text

Original release date: February 26, 2022SummaryActions to Take Today: • Set antivirus and antimalware programs to conduct regular scans. • Enable strong spam filters to prevent phishing emails from reaching end users. • Filter network traffic. • Update software. • Require multifactor authentication. Leading up to Russia’s unprovoked attack against ...

AA22-057A: Update: Destructive Malware Targeting Organizations in Ukraine

Titel

AA22-057A: Update: Destructive Malware Targeting Organizations in Ukraine

Veröffentlicht

26. Februar 2022 16:00

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-057a

Text

Original release date: February 26, 2022 | Last revised: April 28, 2022SummaryActions to Take Today: • Set antivirus and antimalware programs to conduct regular scans. • Enable strong spam filters to prevent phishing emails from reaching end users. • Filter network traffic. • Update software. • Require multifactor authentication. (Updated ...

Donnerstag, 24.02.2022

17:00

AA22-055A : Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

Titel

AA22-055A : Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

Veröffentlicht

24. Februar 2022 17:00

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-055a

Text

Original release date: February 24, 2022SummaryActions to Take Today to Protect Against Malicious Activity * Search for indicators of compromise. * Use antivirus software. * Patch all systems. * Prioritize patching known exploited vulnerabilities. * Train users to recognize and report phishing attempts. * Use multi-factor authentication. Note: this advisory ...

16:15

FATEK Automation FvDesigner

Titel

FATEK Automation FvDesigner

Veröffentlicht

24. Februar 2022 16:15

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-055-01

Text

This advisory contains mitigations for Stack-based Buffer Overflow, Out-of-bounds Write, and Out-of-bounds Read vulnerabilities in FATEK Automation FvDesigner HMI products.

16:10

Mitsubishi Electric EcoWebServerIII

Titel

Mitsubishi Electric EcoWebServerIII

Veröffentlicht

24. Februar 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-055-02

Text

This advisory contains mitigations for Improper Neutralization of Input During Web Page Generation, Uncontrolled Resource Consumption, and Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabilities in the Mitsubishi Electric EcoWebServerIII energy saving data collecting server.

16:05

Schneider Electric Easergy P5 and P3

Titel

Schneider Electric Easergy P5 and P3

Veröffentlicht

24. Februar 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-055-03

Text

This advisory contains mitigations for Use of Hard-coded Credentials, and Classic Buffer Overflow vulnerabilities in Schneider Electric Easergy P5 and P3 medium voltage protection relays.

Baker Hughes Bently Nevada 3500

Titel

Baker Hughes Bently Nevada 3500

Veröffentlicht

24. Februar 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-231-02

Text

This advisory was originally posted to the HSIN ICS library on August 19, 2021, and is being released to the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for a Use of Password Hash with Insufficient Computational Effort vulnerability in the Bently Nevada 3500 machinery protection and monitoring systems.

Mittwoch, 23.02.2022

AA22-054A: New Sandworm Malware Cyclops Blink Replaces VPNFilter

Titel

AA22-054A: New Sandworm Malware Cyclops Blink Replaces VPNFilter

Veröffentlicht

23. Februar 2022 16:00

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-054a

Text

Original release date: February 23, 2022SummaryThe Sandworm actor, which the United Kingdom and the United States have previously attributed to the Russian GRU, has replaced the exposed VPNFilter malware with a new more advanced framework. The United Kingdom's (UK) National Cyber Security Centre (NCSC), the Cybersecurity and Infrastructure Security Agency ...

Dienstag, 22.02.2022

16:10

GE Proficy CIMPLICITY-IPM

Titel

GE Proficy CIMPLICITY-IPM

Veröffentlicht

22. Februar 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-053-01

Text

This advisory contains mitigations for an Improper Privilege Management vulnerability in GE Proficy CIMPLICITY, a HMI and SCADA platform.

16:05

GE Proficy CIMPLICITY-Cleartext

Titel

GE Proficy CIMPLICITY-Cleartext

Veröffentlicht

22. Februar 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-053-02

Text

This advisory contains mitigations for a Cleartext Transmission of Sensitive Information vulnerability in GE Proficy CIMPLICITY, a HMI and SCADA platform.

https://us-cert.cisa.gov/ics/advisories/icsa-22-053-03

WIN-911 2021

Titel

WIN-911 2021

Veröffentlicht

22. Februar 2022 16:00

URL

Text

This advisory contains mitigations for Incorrect Default Permissions vulnerabilities in WIN-911 2021 alarm notification platforms.

SSA-306654 V1.0: Insyde BIOS Vulnerabilities in Siemens Industrial Products

Titel

SSA-306654 V1.0: Insyde BIOS Vulnerabilities in Siemens Industrial Products

Veröffentlicht

22. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf

Text

Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.

Donnerstag, 17.02.2022

SSA-949188 V1.0: File Parsing Vulnerabilities in Simcenter Femap before V2022.1.1

Titel

SSA-949188 V1.0: File Parsing Vulnerabilities in Simcenter Femap before V2022.1.1

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdf

Text

Siemens Simcenter Femap versions before V2022.1.1 are affected by vulnerabilities that could be triggered when the application reads files in .NEU or .BDF format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform ...

SSA-455843 V1.7 (Last Update: 2022-02-17): WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products

Titel

SSA-455843 V1.7 (Last Update: 2022-02-17): WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf

Text

CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section “Vulnerability Classification” below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and ...

SSA-244969 V1.1 (Last Update: 2022-02-17): OpenSSL Vulnerability in Industrial Products

Titel

SSA-244969 V1.1 (Last Update: 2022-02-17): OpenSSL Vulnerability in Industrial Products

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf

Text

OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for several affected products and recommends to update to ...

SSA-772220 V1.7 (Last Update: 2022-02-17): OpenSSL Vulnerabilities in Industrial Products

Titel

SSA-772220 V1.7 (Last Update: 2022-02-17): OpenSSL Vulnerabilities in Industrial Products

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf

Text

OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1k, that allows an unauthenticated attacker to cause a Denial-of-Service (DoS) if a maliciously crafted renegotiation message is sent. Siemens has released updates for several affected products and recommends to update to the latest versions. ...

Mittwoch, 16.02.2022

AA22-047A: Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Inf...

Titel

AA22-047A: Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology

Veröffentlicht

16. Februar 2022 16:00

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-047a

Text

Original release date: February 16, 2022SummaryActions to Help Protect Against Russian State-Sponsored Malicious Cyber Activity: • Enforce multifactor authentication. • Enforce strong, unique passwords. • Enable M365 Unified Audit Logs. • Implement endpoint detection and response tools. From at least January 2020, through February 2022, the Federal Bureau of Investigation ...

Freitag, 11.02.2022

04:55

Siemens Solid Edge, JT2Go, and Teamcenter Visualization

Titel

Siemens Solid Edge, JT2Go, and Teamcenter Visualization

Veröffentlicht

11. Februar 2022 04:55

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-041-07-1

Text

This advisory contains mitigations for Improper Restriction of Operations within the Bounds of a Memory Buffer, Out-of-bounds Write, Heap-based Buffer Overflow, and Out-of-bounds Read vulnerabilities in Siemens Solid Edge, JT2Go, and Teamcenter Visualization software products.

Donnerstag, 10.02.2022

17:25

Siemens SIMATIC Industrial Products

Titel

Siemens SIMATIC Industrial Products

Veröffentlicht

10. Februar 2022 17:25

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-041-01

Text

This advisory contains mitigations for Operation on a Resource after Expiration or Release, and Missing Release of Memory after Effective Lifetime vulnerabilities in Siemens Industrial Products using the SIMATIC firmware platform.

17:20

Siemens SIMATIC WinCC and PCS

Titel

Siemens SIMATIC WinCC and PCS

Veröffentlicht

10. Februar 2022 17:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-041-02

Text

This advisory contains mitigations for a Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Siemens SIMATIC WinCC and PCS industrial automation products.

17:10

SINEMA Remote Connect Server

Titel

SINEMA Remote Connect Server

Veröffentlicht

10. Februar 2022 17:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-041-04

Text

This advisory contains mitigations for an Open Redirect vulnerability in the SINEMA Remote Connect Server, a management platform for remote networks.

17:05

https://us-cert.cisa.gov/ics/advisories/icsa-22-041-05

SICAM TOOLBOX II

Titel

SICAM TOOLBOX II

Veröffentlicht

10. Februar 2022 17:05

URL

Text

This advisory contains mitigations for a Use of Hard-coded Credentials vulnerability in the Siemens SICAM TOOLBOX II software platform.

17:00

Siemens Spectrum Power 4

Titel

Siemens Spectrum Power 4

Veröffentlicht

10. Februar 2022 17:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-041-06

Text

This advisory contains mitigations for a Cross-site scripting vulnerability in Siemens Spectrum Power 4 communications and data modeling software.

16:50

Siemens COMOS Web (Update A)

Titel

Siemens COMOS Web (Update A)

Veröffentlicht

10. Februar 2022 16:50

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-013-05

Text

This updated advisory is a follow-up to the original advisory titled ICSA-22-013-05 Siemens COMOS Web that was published January 13, 2022, to the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for Basic XSS, Relative Path Traversal, SQL Injection, and Cross-site Request Forgery vulnerabilities in the Siemens COMOS Web unified ...

16:45