Bulletins | CERT@VDE

https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01

FXC AE1021/AE1021PE

Titel

FXC AE1021/AE1021PE

Veröffentlicht

21. Dezember 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: FXC Equipment: AE1021, AE1021PE Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution on the device via NTP server ...

Open Design Alliance Drawing SDK

Titel

Open Design Alliance Drawing SDK

Veröffentlicht

19. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Open Design Alliance (ODA) Equipment: Drawing SDK Vulnerabilities: Use after Free, Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote attackers to disclose sensitive information on affected installations of ODA Drawing SDK. ...

EuroTel ETL3100 Radio Transmitter

Titel

EuroTel ETL3100 Radio Transmitter

Veröffentlicht

19. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: EuroTel Equipment: ETL3100 Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Authorization Bypass Through User-Controlled Key, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain ...

Subnet Solutions Inc. PowerSYSTEM Center

Titel

Subnet Solutions Inc. PowerSYSTEM Center

Veröffentlicht

19. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Subnet Solutions Inc. Equipment: PowerSYSTEM Center Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker achieving arbitrary code execution and privilege escalation through the unquoted service path. ...

https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02

EFACEC BCU 500

Titel

EFACEC BCU 500

Veröffentlicht

19. Dezember 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: EFACEC Equipment: BCU 500 Vulnerabilities: Uncontrolled Resource Consumption, Cross-site Request Forgery 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product or compromise the web ...

https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03

EFACEC UC 500E

Titel

EFACEC UC 500E

Veröffentlicht

19. Dezember 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: EFACEC Equipment: UC 500 Vulnerabilities: Cleartext Transmission of Sensitive Information, Open Redirect, Exposure of Sensitive Information to an Unauthorized Actor, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to ...

Siemens SIMATIC and SIPLUS Products

Titel

Siemens SIMATIC and SIPLUS Products

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-05

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens RUGGEDCOM and SCALANCE M-800/S615 Family

Titel

Siemens RUGGEDCOM and SCALANCE M-800/S615 Family

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-14

Text

Siemens Web Server of Industrial Products

Titel

Siemens Web Server of Industrial Products

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-08

Text

Siemens SCALANCE and RUGGEDCOM M-800/S615 Family

Titel

Siemens SCALANCE and RUGGEDCOM M-800/S615 Family

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-13

Text

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1

Titel

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10

Text

Johnson Controls Kantech Gen1 ioSmart

Titel

Johnson Controls Kantech Gen1 ioSmart

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable from adjacent network Vendor: Sensormatic Electronics, LLC, an affiliate of Johnson Controls Inc. Equipment: Kantech Gen1 ioSmart card reader Vulnerability: Missing Release of Memory after Effective Lifetime 2. RISK EVALUATION An attacker with physical access to the Kantech Gen1 ioSmart ...

Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC

Titel

Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-06

Text

Siemens User Management Component (UMC)

Titel

Siemens User Management Component (UMC)

Veröffentlicht

14. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-03

Text

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-05

ControlbyWeb Relay

Titel

ControlbyWeb Relay

Veröffentlicht

7. Dezember 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: ControlByWeb Equipment: X-332 and X-301 Vulnerability: Cross-Site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to run malicious code during a user's session. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

Sierra Wireless AirLink with ALEOS firmware

Titel

Sierra Wireless AirLink with ALEOS firmware

Veröffentlicht

7. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sierra Wireless Equipment: AirLink Vulnerabilities: Infinite Loop, NULL Pointer Dereference, Cross-site Scripting, Reachable Assertion, Use of Hard-coded Credentials, Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to ...

Schweitzer Engineering Laboratories SEL-411L

Titel

Schweitzer Engineering Laboratories SEL-411L

Veröffentlicht

7. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schweitzer Engineering Laboratories Equipment: SEL-411L Vulnerability: Improper Restriction of Rendered UI Layers or Frames 2. RISK EVALUATION Successful exploitation of this vulnerability could expose authorized users to clickjacking attacks. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

Johnson Controls Metasys and Facility Explorer

Titel

Johnson Controls Metasys and Facility Explorer

Veröffentlicht

7. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: Metasys and Facility Explorer Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service by sending invalid credentials. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

05.12.2023

Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d

Titel

Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d

Veröffentlicht

5. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-339-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.4 ATTENTION: Exploitable with adjacent access/low attack complexity Vendor: Zebra Technologies Equipment: ZTC Industrial ZT410, ZTC Desktop GK420d Vulnerability: Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send specially crafted ...

November 2023

30.11.2023

https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03

PTC KEPServerEx

Titel

PTC KEPServerEx

Veröffentlicht

30. November 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: PTC Equipment: KEPServerEX, ThingWorx, OPC-Aggregator Vulnerabilities: Heap-based Buffer Overflow, Improper Validation of Certificate with Host Mismatch 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker gaining Windows SYSTEM-level code execution on the service ...

30.11.2023

Mitsubishi Electric FA Engineering Software Products

Titel

Mitsubishi Electric FA Engineering Software Products

Veröffentlicht

30. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Mitsubishi Electric Equipment: FA Engineering Software Products Vulnerability: External Control of File Name or Path 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a malicious attacker to execute malicious code by tricking legitimate users to ...

28.11.2023

Franklin Electric Fueling Systems Colibri

Titel

Franklin Electric Fueling Systems Colibri

Veröffentlicht

28. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Franklin Electric Fueling Systems Equipment: Colibri Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain login credentials for other users. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

16.11.2023

Siemens Mendix Runtime

Titel

Siemens Mendix Runtime

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-04

Text

16.11.2023