Bulletins | CERT@VDE

https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-03

BrightSign Players

Titel

BrightSign Players

Veröffentlicht

6. Mai 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: BrightSign Equipment: Brightsign Players Vulnerabilities: Execution with Unnecessary Privileges 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for privilege escalation on the device, easily guessed passwords, or for arbitrary code to be executed on ...

06.05.2025

Milesight UG65-868M-EA

Titel

Milesight UG65-868M-EA

Veröffentlicht

6. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Milesight Equipment: UG65-868M-EA Vulnerability: Improper Access Control for Volatile Memory Containing Boot Code 2. RISK EVALUATION Successful exploitation of this vulnerability could allow any user with admin privileges to inject arbitrary shell commands. 3. TECHNICAL DETAILS ...

06.05.2025

Optigo Networks ONS NC600

Titel

Optigo Networks ONS NC600

Veröffentlicht

6. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Optigo Networks Equipment: ONS NC600 Vulnerability: Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to establish an authenticated connection with the hard-coded credentials and perform OS command executions. ...

01.05.2025

KUNBUS GmbH Revolution Pi

Titel

KUNBUS GmbH Revolution Pi

Veröffentlicht

1. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: KUNBUS Equipment: Revolution Pi Vulnerabilities: Missing Authentication for Critical Function, Authentication Bypass by Primary Weakness, Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers ...

April 2025

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

Titel

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: iSTAR Configuration Utility (ICU) Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Johnson Controls ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-05

Johnson Controls ICU

Titel

Johnson Controls ICU

Veröffentlicht

24. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: ICU Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Johnson Controls reports the following ...

Nice Linear eMerge E3

Titel

Nice Linear eMerge E3

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Nice Equipment: Linear eMerge E3 Vulnerability: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands. ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-03

Vestel AC Charger

Titel

Vestel AC Charger

Veröffentlicht

24. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Vestel Equipment: AC Charger Vulnerability: Exposure of Sensitive System Information to an Unauthorized Control Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker access to sensitive information, such as credentials which could ...

Planet Technology Network Products

Titel

Planet Technology Network Products

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Planet Technology Equipment: Planet Technology Network Products Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of ...

ALBEDO Telecom Net.Time - PTP/NTP Clock

Titel

ALBEDO Telecom Net.Time - PTP/NTP Clock

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: ALBEDO Telecom Equipment: Net.Time - PTP/NTP clock Vulnerability: Insufficient Session Expiration 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to ...

Siemens TeleControl Server Basic

Titel

Siemens TeleControl Server Basic

Veröffentlicht

22. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-02

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-04

ABB MV Drives

Titel

ABB MV Drives

Veröffentlicht

22. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: MV Drives Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain full ...

Siemens TeleControl Server Basic SQL

Titel

Siemens TeleControl Server Basic SQL

Veröffentlicht

22. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01

Text

Schneider Electric Wiser Home Controller WHC-5918A

Titel

Schneider Electric Wiser Home Controller WHC-5918A

Veröffentlicht

22. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Wiser Home Controller WHC-5918A Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose sensitive credentials. 3. TECHNICAL DETAILS 3.1 ...

Schneider Electric Trio Q Licensed Data Radio

Titel

Schneider Electric Trio Q Licensed Data Radio

Veröffentlicht

17. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.4 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Trio Q Licensed Data Radio Vulnerabilities: Insecure Storage of Sensitive Information, Initialization of a Resource with an Insecure Default 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access confidential ...

Schneider Electric Sage Series

Titel

Schneider Electric Sage Series

Veröffentlicht

17. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Sage series Vulnerabilities: Out-of-bounds Write, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Default Permissions, Unchecked Return Value, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds ...

Yokogawa Recorder Products

Titel

Yokogawa Recorder Products

Veröffentlicht

17. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Yokogawa Equipment: GX10, GX20, GP10, GP20, GM Data Acquisition System, DX1000, DX2000, DX1000N, FX1000, μR10000, μR20000, MW100, DX1000T, DX2000T, CX1000, CX2000 Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could ...

Schneider Electric ConneXium Network Manager

Titel

Schneider Electric ConneXium Network Manager

Veröffentlicht

17. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: ConneXium Network Manager Vulnerabilities: Files or Directories Accessible to External Parties, Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access sensitive data, escalate privileges, or ...

Growatt Cloud Applications

Titel

Growatt Cloud Applications

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Growatt Equipment: Cloud Applications Vulnerabilities: Cross-site Scripting, Authorization Bypass Through User-Controlled Key, Insufficient Type Distinction, External Control of System or Configuration Setting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to compromise ...

Mitsubishi Electric Europe B.V. smartRTU

Titel

Mitsubishi Electric Europe B.V. smartRTU

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-09

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Europe B.V. Equipment: smartRTU Vulnerability: Missing Authentication for Critical Function, OS Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to disclose, tamper with, destroy or delete ...

Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX

Titel

Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-03

Text

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05

Lantronix Xport

Titel

Lantronix Xport

Veröffentlicht

15. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Lantronix Equipment: Xport Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker unauthorized access to the configuration interface and cause disruption to monitoring and operations. 3. TECHNICAL ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08

ABB M2M Gateway

Titel

ABB M2M Gateway

Veröffentlicht

15. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: M2M Gateway Vulnerabilities: Integer Overflow or Wraparound, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Unquoted Search Path or Element, Untrusted Search Path, Use After Free, Out-of-bounds Write, Buffer Copy without Checking Size of ...

Siemens Industrial Edge Device Kit

Titel

Siemens Industrial Edge Device Kit

Veröffentlicht

15. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-02

Text