Bulletins | CERT@VDE

Siemens Industrial Products with OPC UA (Update B)

Titel

Siemens Industrial Products with OPC UA (Update B)

Veröffentlicht

16. August 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-132-08

Text

This updated advisory is a follow-up to the original advisory titled ICSA-22-132-08 Siemens Industrial Products with OPC UA (Update A) that was published May 12, 2022, on the ICS webpage on cisa.gov/ics. This advisory contains mitigations for various Siemens Industrial Products with OPC UA products.

Siemens Simcenter STAR-CCM+

Titel

Siemens Simcenter STAR-CCM+

Veröffentlicht

11. August 2022 16:54

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-223-01

Text

This advisory contains mitigations for an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in versions of Siemens Simcenter STAR-CCM+ products.

Schneider Electric EcoStruxure, EcoStruxure Process Expert, SCADAPack RemoteConnect for x70

Titel

Schneider Electric EcoStruxure, EcoStruxure Process Expert, SCADAPack RemoteConnect for x70

Veröffentlicht

11. August 2022 16:50

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-223-03

Text

This advisory contains mitigations for Heap-based Buffer Overflow, Wrap or Wraparound, Classic Buffer Overflow, and Out-of-bounds Write vulnerabilities in products using AT&T Labs Compressor (XMill) and Decompressor (XDemill).

Emerson ROC800, ROC800L and DL8000

Titel

Emerson ROC800, ROC800L and DL8000

Veröffentlicht

11. August 2022 16:48

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-223-04

Text

This advisory contains mitigations for an Insufficient Verification of Data Authenticity vulnerability in versions of ROC800, a remote automation controller.

Siemens SICAM A8000 Web Server Module

Titel

Siemens SICAM A8000 Web Server Module

Veröffentlicht

11. August 2022 16:46

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-223-05

Text

This advisory contains mitigations for an Improper Access Control vulnerability in versions of SICAM A8000 Web Server Module products.

Siemens SICAM TOOLBOX II

Titel

Siemens SICAM TOOLBOX II

Veröffentlicht

11. August 2022 16:44

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-223-06

Text

This advisory contains mitigations for a Use of Hard-coded Credentials vulnerability in versions of SICAM TOOLBOX II, a control and monitoring system.

Siemens SIMATIC S7-400 (Update A)

Titel

Siemens SIMATIC S7-400 (Update A)

Veröffentlicht

11. August 2022 16:40

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-104-12

Text

This updated advisory is a follow-up to the advisory update titled ICSA-21-104-12 Siemens SIMATIC S7-400 that was published April 14, 2022, to the ICS webpage on www.cisa.gov/ics. This advisory contains mitigations for an Uncontrolled Resource Consumption vulnerability in the Siemens SIMATIC S7-400.

Siemens Industrial Products Intel CPUs (Update E)

Titel

Siemens Industrial Products Intel CPUs (Update E)

Veröffentlicht

11. August 2022 16:38

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-222-05

Text

This updated advisory is a follow-up to the advisory update titled ICSA-21-222-05 Siemens Industrial Products Intel CPU (Update D) that was published July 14, 2022, to the ICS webpage on www.cisa.gov/ics. This advisory contains mitigations for a Missing Encryption of Sensitive Data vulnerability in versions of Siemens Industrial Products Intel ...

Siemens Industrial Products LLDP (Update C)

Titel

Siemens Industrial Products LLDP (Update C)

Veröffentlicht

11. August 2022 16:36

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07

Text

This updated advisory is a follow-up to the original advisory titled ICSA-21-194-07 Siemens Industrial Products LLDP (Update B) that was published August 10, 2021, on the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Classic Buffer Overflow and Uncontrolled Resource Consumption vulnerabilities in versions of Siemens Industrial Products (LLDP).

09.08.2022

Mitsubishi Electric GT SoftGOT2000

Titel

Mitsubishi Electric GT SoftGOT2000

Veröffentlicht

9. August 2022 16:15

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-221-01

Text

This advisory contains mitigations for Infinite Loop and OS Command Injection vulnerabilities in versions of Mitsubishi Electric GT SoftGOT2000 software.

09.08.2022

https://us-cert.cisa.gov/ics/advisories/icsa-22-221-02

Emerson ControlWave

Titel

Emerson ControlWave

Veröffentlicht

9. August 2022 16:10

URL

Text

This advisory contains mitigations for an Insufficient Verification of Data Authenticity vulnerabilities in Emerson ControlWave products, a programmable controller.

09.08.2022

https://us-cert.cisa.gov/ics/advisories/icsa-22-221-03

Emerson OpenBSI

Titel

Emerson OpenBSI

Veröffentlicht

9. August 2022 16:05

URL

Text

This advisory contains mitigations for Use of Broken or Risky Cryptographic Algorithm and Use of Hard-coded Cryptographic Key vulnerabilities in Emerson OpenBSI, a set of network communication services.

04.08.2022

https://us-cert.cisa.gov/ics/advisories/icsa-22-216-01

Digi ConnectPort X2D

Titel

Digi ConnectPort X2D

Veröffentlicht

4. August 2022 16:05

URL

Text

This advisory contains mitigations for an Execution with Unnecessary Privileges vulnerability in Digi ConnectPort X2D, a connection gateway.

02.08.2022

Delta Electronics DIAEnergie (Update C)

Titel

Delta Electronics DIAEnergie (Update C)

Veröffentlicht

2. August 2022 16:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03

Text

This updated advisory is a follow-up to the advisory update titled ICSA-21-238-03 Delta Electronics DIAEnergie (Update B) that was published March 22, 2022, on the ICS webpage at www.cisa.gov/ics. This advisory contains mitigations for Use of Password Hash with Insufficient Computational Effort, Authentication Bypass Using an Alternate Path or Channel, ...

02.08.2022

Mitsubishi Electric FA Engineering Software Products (Update F)

Titel

Mitsubishi Electric FA Engineering Software Products (Update F)

Veröffentlicht

2. August 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-049-02

Text

his updated advisory is a follow-up to the advisory update titled ICSA-21-049-02 Mitsubishi Electric FA Engineering Software Products (Update E) that was published May 24, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Heap-based Buffer Overflow and Improper Handling of Length Parameter Inconsistency vulnerabilities in various ...

02.08.2022

Mitsubishi Electric Factory Automation Engineering Products (Update H)

Titel

Mitsubishi Electric Factory Automation Engineering Products (Update H)

Veröffentlicht

2. August 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-20-212-04

Text

This updated advisory is a follow-up to the advisory update titled ICSA-20-212-04 Mitsubishi Electric Factory Automation Engineering Products (Update E) that was published May 24, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for an Unquoted Search Path or Element vulnerability in various Mitsubishi Electric Factory Automation ...

Juli 2022

28.07.2022

Rockwell Products Impacted by Chromium Type Confusion

Titel

Rockwell Products Impacted by Chromium Type Confusion

Veröffentlicht

28. Juli 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-209-01

Text

This advisory contains mitigations for a Type Confusion vulnerability in various Rockwell Automation products.

28.07.2022

Mitsubishi Electric FA Engineering Software (Update B)

Titel

Mitsubishi Electric FA Engineering Software (Update B)

Veröffentlicht

28. Juli 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05

Text

This updated advisory is a follow-up to the advisory update titled ICSA-21-350-05 Mitsubishi Electric FA Engineering Software (Update A) that was published December 16, 2021, on the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Out-of-bounds Read and Integer Underflow vulnerabilities in Mitsubishi Electric FA Engineering Software, an engineering ...

28.07.2022

Mitsubishi Electric Factory Automation Engineering Software (Update C)

Titel

Mitsubishi Electric Factory Automation Engineering Software (Update C)

Veröffentlicht

28. Juli 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-20-212-02

Text

This updated advisory is a follow-up to the advisory update titled ICSA-20-212-02 Mitsubishi Electric Factory Automation Engineering Software (Update B) that was published May 31, 2021, to the ICS webpage on ucisa.gov/ics.

https://us-cert.cisa.gov/ics/advisories/icsa-22-207-04

MOXA NPort 5110

Titel

MOXA NPort 5110

Veröffentlicht

26. Juli 2022 16:20

URL

Text

This advisory contains mitigations for an Out-of-bounds Write vulnerability in MOXA NPort 5110, a device server.

Honeywell Saia Burgess PG5 PCD

Titel

Honeywell Saia Burgess PG5 PCD

Veröffentlicht

26. Juli 2022 16:15

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-207-03

Text

This advisory contains mitigations for Authentication Bypass and Use of a Broken or Risky Cryptographic Algorithm vulnerabilities in Honeywell Saia Burgess PG5 PCD, a PLC.

Honeywell Safety Manager

Titel

Honeywell Safety Manager

Veröffentlicht

26. Juli 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-207-02

Text

This advisory contains mitigations for Insufficient Verification of Data Authenticity, Missing Authentication for Critical Function, and Use of Hard-coded Credentials vulnerabilities in Honeywell Safety Manager, a safety solution of the Experion Process Knowledge System.

Mitsubishi Electric MELSEC and MELIPC Series (Update D)

Titel

Mitsubishi Electric MELSEC and MELIPC Series (Update D)

Veröffentlicht

26. Juli 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02

Text

This updated advisory is a follow up to the advisory update titled ICSA-21-334-02 Mitsubishi Electric MELSEC and MELIPC Series (Update C) that was published June 7, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Uncontrolled Resource Consumption, Improper Handling of Length Parameter Inconsistency, and Improper Input ...

22.07.2022

AutomationDirect Stride Field I/O

Titel

AutomationDirect Stride Field I/O

Veröffentlicht

22. Juli 2022 04:25

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-202-05

Text

This advisory contains mitigations for an Cleartext Transmission of Sensitive Information vulnerability in AutomationDirect products.

21.07.2022