Bulletins | CERT@VDE

Schneider Electric EcoStruxure Power Automation System

Titel

Schneider Electric EcoStruxure Power Automation System

Veröffentlicht

18. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: WebHMI – Deployed with EcoStruxure Power Automation System Vulnerability: Initialization of a Resource with an Insecure Default 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthorized access to the underlying software ...

Rockwell Automation Lifecycle Services with VMware

Titel

Rockwell Automation Lifecycle Services with VMware

Veröffentlicht

18. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Low attack complexity/public exploits are available/known public exploitation Vendor: Rockwell Automation Equipment: Industrial Data Center (IDC) with VMware, VersaVirtual Appliance (VVA) with VMware, Threat Detection Managed Services (TDMS) with VMware, Endpoint Protection Service with RA Proxy & VMware, Engineered and Integrated ...

Schneider Electric EcoStruxure Panel Server

Titel

Schneider Electric EcoStruxure Panel Server

Veröffentlicht

18. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 4.0 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: EcoStruxure Panel Server Vulnerability: Insertion of Sensitive Information into Log File 2. RISK EVALUATION Successful exploitation of this vulnerability could allow disclosure of sensitive information, including the disclosure of credentials. 3. TECHNICAL DETAILS 3.1 ...

Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI)

Titel

Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI)

Veröffentlicht

18. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.0 ATTENTION: Low Attack Complexity Vendor: Schneider Electric Equipment: EcoStruxure Power Automation System User Interface (EPAS-UI) Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass device authentication, potentially gain access to sensitive information, or execute ...

Schneider Electric ASCO 5310/5350 Remote Annunciator

Titel

Schneider Electric ASCO 5310/5350 Remote Annunciator

Veröffentlicht

18. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: ASCO 5310 / 5350 Vulnerabilities: Download of Code Without Integrity Check, Allocation of Resources Without Limits or Throttling, Cleartext Transmission of Sensitive Information, Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION ...

Siemens SIMATIC IPC Family, ITP1000, and Field PGs

Titel

Siemens SIMATIC IPC Family, ITP1000, and Field PGs

Veröffentlicht

13. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-11

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-09

Siemens OPC UA

Titel

Siemens OPC UA

Veröffentlicht

13. März 2025 13:00

URL

Text

Siemens SIMATIC S7-1500 TM MFP

Titel

Siemens SIMATIC S7-1500 TM MFP

Veröffentlicht

13. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-03

Text

Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation

Titel

Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation

Veröffentlicht

13. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-01

Text

Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP

Titel

Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP

Veröffentlicht

13. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-04

Text

Siemens SCALANCE M-800 and SC-600 Families

Titel

Siemens SCALANCE M-800 and SC-600 Families

Veröffentlicht

13. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-07

Text

Sungrow iSolarCloud Android App WiNet Firmware

Titel

Sungrow iSolarCloud Android App WiNet Firmware

Veröffentlicht

13. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-12

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.5 ATTENTION: Exploitable remotely Vendor: Sungrow Equipment: iSolarCloud Android App, WiNet Firmware Vulnerabilities: Improper Certificate Validation, Use of a Broken or Risky Cryptographic Algorithm, Authorization Bypass Through User-Controlled Key, User of Hard-Coded Credentials, Stack-Based Buffer Overflow, Heap-Based Buffer Overflow 2. RISK EVALUATION Successful ...

Siemens SINAMICS S200

Titel

Siemens SINAMICS S200

Veröffentlicht

13. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-05

Text

11.03.2025

Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool

Titel

Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool

Veröffentlicht

11. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Optigo Networks Equipment: Visual BACnet Capture Tool, Optigo Visual Networks Capture Tool Vulnerabilities: Use of Hard-coded, Security-relevant Constants, Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow ...

11.03.2025

Schneider Electric Uni-Telway Driver

Titel

Schneider Electric Uni-Telway Driver

Veröffentlicht

11. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Uni-Telway Driver Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a denial of service. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Schneider Electric reports the ...

Keysight Ixia Vision Product Family

Titel

Keysight Ixia Vision Product Family

Veröffentlicht

4. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Keysight Equipment: Ixia Vision Product Family Vulnerabilities: Path Traversal, Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device being accessed; a buffer overflow condition may allow ...

Hitachi Energy MACH PS700

Titel

Hitachi Energy MACH PS700

Veröffentlicht

4. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.7 ATTENTION: Vendor: Hitachi Energy Equipment: MACH PS700 Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate privileges and gain control over the software. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi Energy reports ...

Edimax IC-7100 IP Camera

Titel

Edimax IC-7100 IP Camera

Veröffentlicht

4. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Edimax Equipment: IC-7100 IP Camera Vulnerability: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send ...

Hitachi Energy UNEM/ECST

Titel

Hitachi Energy UNEM/ECST

Veröffentlicht

4. März 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Low Attack Complexity Vendor: Hitachi Energy Equipment: XMC20, ECST, UNEM Vulnerability: Improper Validation of Certificate with Host Mismatch 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to intercept or falsify data exchanges between the client and the server. ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-07

GMOD Apollo

Titel

GMOD Apollo

Veröffentlicht

4. März 2025 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: GMOD Equipment: Apollo Vulnerabilities: Incorrect Privilege Assignment, Relative Path Traversal, Missing Authentication for Critical Function, Generation of Error Message Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-04

Hitachi Energy XMC20

Titel

Hitachi Energy XMC20

Veröffentlicht

4. März 2025 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: XMC20 Vulnerability: Relative Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access files or directories outside the authorized scope. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi ...

Februar 2025

27.02.2025

Schneider Electric Communication Modules for Modicon M580 and Quantum Controllers

Titel

Schneider Electric Communication Modules for Modicon M580 and Quantum Controllers

Veröffentlicht

27. Februar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-058-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Communication modules for Modicon M580 and Quantum controllers Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a stack overflow attack, which could result in loss of confidentiality, integrity, ...

25.02.2025

Rockwell Automation PowerFlex 755

Titel

Rockwell Automation PowerFlex 755

Veröffentlicht

25. Februar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-056-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Rockwell Automation Equipment: PowerFlex 755 Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could result in exposure of sensitive data. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following version of ...

20.02.2025

Rapid Response Monitoring My Security Account App

Titel

Rapid Response Monitoring My Security Account App

Veröffentlicht

20. Februar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rapid Response Monitoring Equipment: My Security Account App Vulnerability: Authorization Bypass Through User-Controlled Key 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attacker to access sensitive information of other users. 3. TECHNICAL DETAILS 3.1 ...

20.02.2025