Bulletins | CERT@VDE

goTenna Pro X and Pro X2

Titel

goTenna Pro X and Pro X2

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro series Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Improper Restriction of Communication Channel to Intended Endpoints, Use of Cryptographically Weak Pseudo-Random Number ...

26.09.2024

goTenna Pro X and Pro X2 (Update A)

Titel

goTenna Pro X and Pro X2 (Update A)

Veröffentlicht

26. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Text

Franklin Fueling Systems TS-550 EVO

Titel

Franklin Fueling Systems TS-550 EVO

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Franklin Fueling Systems Equipment: TS-550 EVO Automatic Tank Gauge Vulnerability: Absolute Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability allow an attacker to gain administrative access over the affected device. 3. TECHNICAL DETAILS 3.1 ...

OPW Fuel Management Systems SiteSentinel

Titel

OPW Fuel Management Systems SiteSentinel

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OPW Fuel Managements Systems Equipment: SiteSentinel Vulnerability: Missing Authentication For Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass authentication and obtain full administrative privileges to the server. 3. ...

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE

Titel

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Dover Fueling Solutions (DFS) Equipment: ProGauge MAGLINK LX CONSOLE Vulnerabilities: Command Injection, Improper Privilege Management, Use of Hard-coded Password, Cross-site Scripting, Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of these ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-05

Moxa MXview One

Titel

Moxa MXview One

Veröffentlicht

24. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Moxa Equipment: MXview One, MXview One Central Manager Series Vulnerabilities: Cleartext Storage In A File or On Disk, Path Traversal, Time-of-Check Time-of-Use Race Condition 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-02

Alisonic Sibylla

Titel

Alisonic Sibylla

Veröffentlicht

24. September 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Alisonic Equipment: Sibylla Vulnerability: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker obtaining device information from the database, dumping ...

OMNTEC Proteus Tank Monitoring

Titel

OMNTEC Proteus Tank Monitoring

Veröffentlicht

24. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OMNTEC Mfg., Inc. Equipment: Proteus Tank Monitoring Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform administrative actions without proper authentication. 3. TECHNICAL DETAILS 3.1 ...

Kastle Systems Access Control System

Titel

Kastle Systems Access Control System

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Kastle Systems Equipment: Access Control System Vulnerabilities: Use of Hard-coded Credentials, Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information on the affected product. ...

Rockwell Automation RSLogix 5 and RSLogix 500

Titel

Rockwell Automation RSLogix 5 and RSLogix 500

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable locally/high attack complexity Vendor: Rockwell Automation Equipment: RSLogix 5 and RSLogix 500 Vulnerability: Insufficient verification of data authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

MegaSys Computer Technologies Telenium Online Web Application

Titel

MegaSys Computer Technologies Telenium Online Web Application

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: MegaSys Computer Technologies Equipment: Telenium Online Web Application Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to inject arbitrary Perl code through a crafted HTTP request, leading to ...

IDEC CORPORATION WindLDR and WindO/I-NV4

Titel

IDEC CORPORATION WindLDR and WindO/I-NV4

Veröffentlicht

19. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: IDEC Corporation Equipment: WindLDR, WindO/I-NV4 Vulnerability: Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of WindLDR ...

17.09.2024

Yokogawa Dual-redundant Platform for Computer (PC2CKM)

Titel

Yokogawa Dual-redundant Platform for Computer (PC2CKM)

Veröffentlicht

17. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Yokogawa Equipment: Dual-redundant Platform for Computer (PC2CKM) Vulnerability: Unchecked Return Value 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a denial-of-service. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions ...

17.09.2024

Millbeck Communications Proroute H685t-w

Titel

Millbeck Communications Proroute H685t-w

Veröffentlicht

17. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Millbeck Communications Equipment: Proroute H685t-w Vulnerabilities: Command Injection, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary commands on the device's operating system. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

Rockwell Automation FactoryTalk Batch View

Titel

Rockwell Automation FactoryTalk Batch View

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-22

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: FactoryTalk Batch View Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker bypassing authentication. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell Automation FactoryTalk Batch ...

Rockwell Automation FactoryTalk View Site

Titel

Rockwell Automation FactoryTalk View Site

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-23

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform unauthenticated remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell ...

Rockwell Automation AADvance Trusted SIS Workstation

Titel

Rockwell Automation AADvance Trusted SIS Workstation

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-20

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: AADvance Trusted SIS Workstation Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker executing code within the context of a current process. 3. TECHNICAL DETAILS 3.1 ...

Siemens SINUMERIK ONE, SINUMERIK 840D and SINUMERIK 828D

Titel

Siemens SINUMERIK ONE, SINUMERIK 840D and SINUMERIK 828D

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-02

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

AutomationDirect DirectLogic H2-DM1E

Titel

AutomationDirect DirectLogic H2-DM1E

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-17

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable from an adjacent network/low attack complexity Vendor: AutomationDirect Equipment: DirectLogic H2-DM1E Vulnerabilities: Session Fixation, Authentication Bypass by Capture-replay 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to inject traffic into an ongoing authenticated session or authenticate ...

Siemens SIMATIC SCADA and PCS 7 Systems

Titel

Siemens SIMATIC SCADA and PCS 7 Systems

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-14

Text

10.09.2024

Rockwell Automation SequenceManager

Titel

Rockwell Automation SequenceManager

Veröffentlicht

10. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: SequenceManager Vulnerabilities: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of SequenceManager, a logix ...

10.09.2024

Viessmann Climate Solutions SE Vitogate 300

Titel

Viessmann Climate Solutions SE Vitogate 300

Veröffentlicht

10. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Viessmann Climate Solutions SE Equipment: Vitogate 300 Vulnerabilities: Use of Hard-coded Credentials, Forced Browsing, Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to achieve remote code execution. ...

10.09.2024

iniNet Solutions SpiderControl SCADA Web Server

Titel

iniNet Solutions SpiderControl SCADA Web Server

Veröffentlicht

10. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: iniNet Solutions GmbH Equipment: SpiderControl SCADA Web Server Vulnerabilities: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to log in or execute arbitrary code. 3. ...

05.09.2024

Hughes Network Systems WL3000 Fusion Software

Titel

Hughes Network Systems WL3000 Fusion Software

Veröffentlicht

5. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-249-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: Hughes Network Systems Equipment: WL3000 Fusion Software Vulnerabilities: Insufficiently Protected Credentials, Missing Encryption of Sensitive Data 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to obtain read-only access to network configuration information and ...

03.09.2024