Bulletins | CERT@VDE

Siemens SIMATIC S7-1500 CPU Family

Titel

Siemens SIMATIC S7-1500 CPU Family

Veröffentlicht

12. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

AVEVA PI Data Archive

Titel

AVEVA PI Data Archive

Veröffentlicht

12. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: PI Data Archive Vulnerabilities: Uncaught Exception, Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could shut down necessary subsystems and cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

PTZOptics and Other Pan-Tilt-Zoom Cameras

Titel

PTZOptics and Other Pan-Tilt-Zoom Cameras

Veröffentlicht

12. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: ValueHD, PTZOptics, multiCAM Systems, SMTAV Equipment: Various pan-tilt-zoom cameras Vulnerabilities: Improper Authentication, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of these ...

AVEVA PI Connector for CygNet

Titel

AVEVA PI Connector for CygNet

Veröffentlicht

12. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Low attack complexity Vendor: AVEVA Equipment: PI Connector for CygNet Vulnerabilities: Cross-site Scripting, Improper Validation of Integrity Check Value 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to persist arbitrary code in the administrative portal of the ...

Siemens SCALANCE and RUGGEDCOM

Titel

Siemens SCALANCE and RUGGEDCOM

Veröffentlicht

12. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-04

Text

Siemens Energy Services

Titel

Siemens Energy Services

Veröffentlicht

12. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-06

Text

10.06.2025

Hitachi Energy Relion 670, 650, SAM600-IO Series

Titel

Hitachi Energy Relion 670, 650, SAM600-IO Series

Veröffentlicht

10. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.2 ATTENTION: Exploitable remotely Vendor: Hitachi Energy Equipment: Relion 670, 650, SAM600-IO Series Vulnerability: Observable Discrepancy 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to decrypt application data in transit. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi Energy reports ...

10.06.2025

SinoTrack GPS Receiver

Titel

SinoTrack GPS Receiver

Veröffentlicht

10. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: SinoTrack Equipment: All Known SinoTrack Devices Vulnerabilities: Weak Authentication, Observable Response Discrepency 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface. ...

05.06.2025

Hitachi Energy Relion 670, 650 Series and SAM600-IO Product

Titel

Hitachi Energy Relion 670, 650 Series and SAM600-IO Product

Veröffentlicht

5. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Relion 670, Relion 650, SAM600-IO Vulnerabilities: Integer Overflow or Wraparound 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption on the products. 3. TECHNICAL DETAILS 3.1 ...

05.06.2025

CyberData 011209 SIP Emergency Intercom

Titel

CyberData 011209 SIP Emergency Intercom

Veröffentlicht

5. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: CyberData Equipment: 011209 SIP Emergency Intercom Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Missing Authentication for Critical Function, SQL Injection, Insufficiently Protected Credentials, Path Traversal: '.../...//' 2. RISK EVALUATION Successful exploitation of these vulnerabilities ...

03.06.2025

Schneider Electric Wiser Home Automation

Titel

Schneider Electric Wiser Home Automation

Veröffentlicht

3. Juni 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-153-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Wiser AvatarOn 6K Freelocate, Wiser Cuadro H 5P Socket Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to ...

Mai 2025

29.05.2025

https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-01

Siemens SiPass

Titel

Siemens SiPass

Veröffentlicht

29. Mai 2025 14:00

URL

Text

29.05.2025

https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-04

Instantel Micromate

Titel

Instantel Micromate

Veröffentlicht

29. Mai 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Instantel Equipment: Micromate Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to access the device's configuration port and execute commands. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

29.05.2025

Consilium Safety CS5000 Fire Panel

Titel

Consilium Safety CS5000 Fire Panel

Veröffentlicht

29. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Consilium Safety Equipment: CS5000 Fire Panel Vulnerabilities: Initialization of a Resource with an Insecure Default, Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain high-level access to ...

27.05.2025

Johnson Controls iSTAR Configuration Utility (ICU) Tool

Titel

Johnson Controls iSTAR Configuration Utility (ICU) Tool

Veröffentlicht

27. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-146-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.3 ATTENTION: Low attack complexity Vendor: Johnson Controls Inc. Equipment: iSTAR Configuration Utility (ICU) tool Vulnerability: Use of Uninitialized Variable 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to gain access to memory leaked from the ICU. 3. TECHNICAL ...

22.05.2025

Rockwell Automation FactoryTalk Historian ThingWorx

Titel

Rockwell Automation FactoryTalk Historian ThingWorx

Veröffentlicht

22. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-142-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: 95057C-FTHTWXCT11 Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to launch XXE-based attacks on applications that accept malicious log4net configuration files. ...

22.05.2025

Lantronix Device Installer

Titel

Lantronix Device Installer

Veröffentlicht

22. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-142-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Low attack complexity Vendor: Lantronix Equipment: Device Installer Vulnerability: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain access to the host machine running the Device Installer software. 3. ...

AutomationDirect MB-Gateway

Titel

AutomationDirect MB-Gateway

Veröffentlicht

20. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-09

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: AutomationDirect Equipment: MB-Gateway Vulnerability: Missing Authentication For Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to make configuration changes, disrupt operations, or achieve arbitrary code execution. 3. TECHNICAL DETAILS 3.1 ...

Vertiv Liebert RDU101 and UNITY

Titel

Vertiv Liebert RDU101 and UNITY

Veröffentlicht

20. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-10

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Vertiv Equipment: Liebert RDU101 and Liebert UNITY Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition ...

Assured Telematics Inc (ATI) Fleet Management System with Geotab Integration

Titel

Assured Telematics Inc (ATI) Fleet Management System with Geotab Integration

Veröffentlicht

20. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Assured Telematics Inc. Equipment: Fleet Management System Vulnerabilities: Exposure of Sensitive System Information to an Unauthorized Control Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker collecting sensitive file system information ...

National Instruments Circuit Design Suite

Titel

National Instruments Circuit Design Suite

Veröffentlicht

20. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: National Instruments Equipment: Circuit Design Suite Vulnerabilities: Out-of-bounds Write, Out-of-bounds Read, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code. 3. TECHNICAL DETAILS 3.1 ...

Assured Telematics Inc (ATI) Fleet Management System (Update A)

Titel

Assured Telematics Inc (ATI) Fleet Management System (Update A)

Veröffentlicht

20. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11

Text

ABUP IoT Cloud Platform

Titel

ABUP IoT Cloud Platform

Veröffentlicht

20. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable remotely/Low attack complexity Vendor: ABUP Equipment: ABUP Internet of Things (IoT) Cloud Platform Vulnerability: Incorrect Privilege Assignment 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized. 3. ...

Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL

Titel

Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL

Veröffentlicht

20. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Galaxy VS, Galaxy VL, Galaxy VXL Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform unauthenticated remote code execution. 3. TECHNICAL DETAILS ...