Bulletins | CERT@VDE

Siemens HiMed Cockpit

Titel

Siemens HiMed Cockpit

Veröffentlicht

10. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-08

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-07

Siemens JT2Go

Titel

Siemens JT2Go

Veröffentlicht

10. Oktober 2024 14:00

URL

Text

Rockwell Automation PowerFlex 6000T

Titel

Rockwell Automation PowerFlex 6000T

Veröffentlicht

10. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-19

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: PowerFlex 6000T Vulnerability: Improper Check for Unusual or Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...

Rockwell Automation ControlLogix

Titel

Rockwell Automation ControlLogix

Veröffentlicht

10. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-20

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ControlLogix Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send a specially crafted CIP message and cause a denial-of-service condition on the affected device. ...

Siemens SENTRON PAC3200 Devices

Titel

Siemens SENTRON PAC3200 Devices

Veröffentlicht

10. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-04

Text

Rockwell Automation Verve Asset Manager

Titel

Rockwell Automation Verve Asset Manager

Veröffentlicht

10. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-17

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Verve Asset Manager Vulnerability: Placement of User into Incorrect Group 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized user to access previous data they should no longer have access ...

03.10.2024

TEM Opera Plus FM Family Transmitter

Titel

TEM Opera Plus FM Family Transmitter

Veröffentlicht

3. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: TEM Equipment: Opera Plus FM Family Transmitter Vulnerabilities: Missing Authentication for Critical Function, Cross-Site Request Forgery (CSRF) 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform remote code ...

01.10.2024

Mitsubishi Electric MELSEC iQ-F FX5-OPC

Titel

Mitsubishi Electric MELSEC iQ-F FX5-OPC

Veröffentlicht

1. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F FX5-OPC Vulnerability: NULL Pointer Dereference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to cause a Denial-of-Service (DoS) condition on the product by getting a legitimate ...

01.10.2024

Optigo Networks ONS-S8 Spectra Aggregation Switch

Titel

Optigo Networks ONS-S8 Spectra Aggregation Switch

Veröffentlicht

1. Oktober 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Optigo Networks Equipment: ONS-S8 - Spectra Aggregation Switch Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), Weak Authentication 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...

September 2024

Atelmo Atemio AM 520 HD Full HD Satellite Receiver

Titel

Atelmo Atemio AM 520 HD Full HD Satellite Receiver

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Atelmo Equipment: Atemio AM 520 HD Full HD Satellite Receiver Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized attacker to execute system commands with elevated ...

goTenna Pro X and Pro X2 (Update A)

Titel

goTenna Pro X and Pro X2 (Update A)

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro series Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Improper Restriction of Communication Channel to Intended Endpoints, Use of Cryptographically Weak Pseudo-Random Number ...

goTenna Pro X and Pro X2

Titel

goTenna Pro X and Pro X2

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Text

goTenna Pro ATAK Plugin

Titel

goTenna Pro ATAK Plugin

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro ATAK Plugin Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Weak Authentication, Insertion of Sensitive ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02

Advantech ADAM-5630

Titel

Advantech ADAM-5630

Veröffentlicht

26. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Advantech Equipment: ADAM-5630 Vulnerabilities: Use of Persistent Cookies Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to hijack a legitimate user's session, perform cross-site request forgery, or cause a denial-of-service ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01

Advantech ADAM-5550

Titel

Advantech ADAM-5550

Veröffentlicht

26. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: Advantech Equipment: ADAM-5550 Vulnerabilities: Weak Encoding for Password, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote attacker to intercept the easily decodable credentials of a legitimate user to gain full access ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-05

Moxa MXview One

Titel

Moxa MXview One

Veröffentlicht

24. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Moxa Equipment: MXview One, MXview One Central Manager Series Vulnerabilities: Cleartext Storage In A File or On Disk, Path Traversal, Time-of-Check Time-of-Use Race Condition 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker ...

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE

Titel

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Dover Fueling Solutions (DFS) Equipment: ProGauge MAGLINK LX CONSOLE Vulnerabilities: Command Injection, Improper Privilege Management, Use of Hard-coded Password, Cross-site Scripting, Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of these ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-02

Alisonic Sibylla

Titel

Alisonic Sibylla

Veröffentlicht

24. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Alisonic Equipment: Sibylla Vulnerability: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker obtaining device information from the database, dumping ...

Franklin Fueling Systems TS-550 EVO

Titel

Franklin Fueling Systems TS-550 EVO

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Franklin Fueling Systems Equipment: TS-550 EVO Automatic Tank Gauge Vulnerability: Absolute Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability allow an attacker to gain administrative access over the affected device. 3. TECHNICAL DETAILS 3.1 ...

OPW Fuel Management Systems SiteSentinel

Titel

OPW Fuel Management Systems SiteSentinel

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OPW Fuel Managements Systems Equipment: SiteSentinel Vulnerability: Missing Authentication For Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass authentication and obtain full administrative privileges to the server. 3. ...

OMNTEC Proteus Tank Monitoring

Titel

OMNTEC Proteus Tank Monitoring

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OMNTEC Mfg., Inc. Equipment: Proteus Tank Monitoring Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform administrative actions without proper authentication. 3. TECHNICAL DETAILS 3.1 ...

IDEC CORPORATION WindLDR and WindO/I-NV4

Titel

IDEC CORPORATION WindLDR and WindO/I-NV4

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: IDEC Corporation Equipment: WindLDR, WindO/I-NV4 Vulnerability: Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of WindLDR ...

Rockwell Automation RSLogix 5 and RSLogix 500

Titel

Rockwell Automation RSLogix 5 and RSLogix 500

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable locally/high attack complexity Vendor: Rockwell Automation Equipment: RSLogix 5 and RSLogix 500 Vulnerability: Insufficient verification of data authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

Kastle Systems Access Control System

Titel

Kastle Systems Access Control System

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Kastle Systems Equipment: Access Control System Vulnerabilities: Use of Hard-coded Credentials, Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information on the affected product. ...