Bulletins | CERT@VDE

Siemens SICAM P850 and SICAM P855

Titel

Siemens SICAM P850 and SICAM P855

Veröffentlicht

12. Mai 2022 16:40

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-132-07

Text

This advisory contains mitigations for Improper Neutralization of Parameter/Argument Delimiters, Cleartext Transmission of Sensitive Information, Cross-site Scripting, Missing Authentication for Critical Function, Authentication Bypass by Capture-replay, and Improper Authentication vulnerabilities in Siemens SICAM P850 and SICAM P855.

12.05.2022

Siemens JT2GO and Teamcenter Visualization

Titel

Siemens JT2GO and Teamcenter Visualization

Veröffentlicht

12. Mai 2022 16:36

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-132-09

Text

This advisory contains mitigations for Infinite Loop, Null Pointer Dereference, Integer Overflow to Buffer Overflow, Double Free, and Access of Uninitialized Pointer vulnerabilities in Siemens JT2GO, Teamcenter Visualization products.

12.05.2022

Siemens Desigo PXC and DXR Devices

Titel

Siemens Desigo PXC and DXR Devices

Veröffentlicht

12. Mai 2022 16:34

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-132-10

Text

This advisory contains mitigations for an Uncaught Exception vulnerability in the Siemens Desigo DXR and PXC controllers.

Adminer in Industrial Products

Titel

Adminer in Industrial Products

Veröffentlicht

10. Mai 2022 16:25

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-130-01

Text

This advisory contains mitigations for a Files or Directories Accessible to External Parties vulnerability in the Adminer database tool.

Eaton Intelligent Power Protector

Titel

Eaton Intelligent Power Protector

Veröffentlicht

10. Mai 2022 16:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-130-02

Text

This advisory contains mitigations for a Cross-site Scripting vulnerability in the Eaton Intelligent Power Protector (IPP) power protection platform.

Eaton Intelligent Power Manager Infrastructure

Titel

Eaton Intelligent Power Manager Infrastructure

Veröffentlicht

10. Mai 2022 16:15

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-130-03

Text

This advisory contains mitigations for Cross-site Scripting, Reflected Cross-site Scripting, and Improper Neutralization of Formula in a CSV File vulnerabilities in Eaton Intelligent Power Manager Infrastructure power monitoring products.

AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere

Titel

AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere

Veröffentlicht

10. Mai 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-130-05

Text

This advisory contains mitigations for an Exposure of Resource to Wrong Sphere vulnerability in AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere HMI products.

Mitsubishi Electric MELSOFT GT OPC UA

Titel

Mitsubishi Electric MELSOFT GT OPC UA

Veröffentlicht

10. Mai 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-130-06

Text

This advisory contains mitigations for Out-of-bounds Read, and Integer Overflow or Wraparound vulnerabilities in Mitsubishi Electric MELSOFT GT OPC UA client connection products.

03.05.2022

Yokogawa CENTUM and ProSafe-RS

Titel

Yokogawa CENTUM and ProSafe-RS

Veröffentlicht

3. Mai 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-123-01

Text

This advisory contains mitigations for a OS Command Injection, Improper Authentication, NULL Pointer Dereference, Improper Input Validation, Resource Management Errors vulnerabilities in Yokogawa CENTUM and ProSafe-RS Distributed Control System and Safety Instrumented System products.

April 2022

26.04.2022

Hitachi Energy System Data Manager

Titel

Hitachi Energy System Data Manager

Veröffentlicht

26. April 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-116-01

Text

This advisory contains mitigations for a Integer Overflow or Wraparound, Reachable Assertion, Type Confusion, Uncontrolled Recursion, and Observable Discrepancy vulnerabilities in Hitachi Energy System Data Manager products.

26.04.2022

Mitsubishi Electric MELSEC and MELIPC Series (Update B)

Titel

Mitsubishi Electric MELSEC and MELIPC Series (Update B)

Veröffentlicht

26. April 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02

Text

This updated advisory is a follow up to the advisory update titled ICSA-21-334-02 Mitsubishi Electric MELSEC and MELIPC Series (Update A) that was published January 27, 2022, to the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for Uncontrolled Resource Consumption, Improper Handling of Length Parameter Inconsistency, and Improper Input ...

21.04.2022

Delta Electronics ASDA-Soft

Titel

Delta Electronics ASDA-Soft

Veröffentlicht

21. April 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-111-01

Text

This advisory contains mitigations for Out-of-bounds Write, and Out-of-bounds Read vulnerabilities in Delta Electronics ASDA-Soft servo software.

21.04.2022

Johnson Controls Metasys SCT Pro

Titel

Johnson Controls Metasys SCT Pro

Veröffentlicht

21. April 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-111-02

Text

This advisory contains mitigations for a Server-side Request Forgery vulnerability in Johnson Controls Metasys SCT Pro building automation software.

21.04.2022

Hitachi Energy MicroSCADA Pro/X SYS600

Titel

Hitachi Energy MicroSCADA Pro/X SYS600

Veröffentlicht

21. April 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-111-03

Text

This advisory contains mitigations for Observable Discrepancy, HTTP Request Smuggling, Classic Buffer Overflow, Improper Certificate Validation, Improper Restriction of Operations within the Bounds of a Memory Buffer, and Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities in the Hitachi Energy MicroSCADA Pro/X SYS600 SCADA product.

Interlogix Hills ComNav

Titel

Interlogix Hills ComNav

Veröffentlicht

19. April 2022 16:25

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-109-01

Text

This advisory contains mitigations for Improper Restriction of Excessive Authentication Attempts, and Inadequate Encryption Strength vulnerability in Interlogix Hills ComNav remote access integration modules.

Automated Logic WebCTRL

Titel

Automated Logic WebCTRL

Veröffentlicht

19. April 2022 16:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-109-02

Text

This advisory contains mitigations for n Open Redirect vulnerability inAutomated Logic WebCTRL building automation software.

FANUC ROBOGUIDE Simulation Platform

Titel

FANUC ROBOGUIDE Simulation Platform

Veröffentlicht

19. April 2022 16:15

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-109-03

Text

This advisory contains mitigations for Incorrect Permission Assignment for Critical Resource, Improper Access Control, Path Traversal, Improper Restriction of XML External Entity Reference, and Uncontrolled Resource Consumption vulnerabilities in FANUC ROBOGUIDE simulation software for FANUC robots.

Elcomplus SmartPTT SCADA

Titel

Elcomplus SmartPTT SCADA

Veröffentlicht

19. April 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-109-04

Text

This advisory contains mitigations for Path Traversal, Unrestricted Upload of File with Dangerous Type, Improper Authorization, and Cross-site Scripting vulnerabilities in Elcomplus SmartPTT SCADA voice and data dispatch software.

Elcomplus SmartPPT SCADA

Titel

Elcomplus SmartPPT SCADA

Veröffentlicht

19. April 2022 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-109-04

Text

Elcomplus SmartPTT SCADA Server

Titel

Elcomplus SmartPTT SCADA Server

Veröffentlicht

19. April 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-109-05

Text

This advisory contains mitigations for Cross-site Scripting, Unauthorized Exposure to Sensitive Information, Unrestricted Upload of File with Dangerous Type, Path Traversal, and Cross-site Request Forgery vulnerabilities in the Elcomplus SmartPTT SCADA Server voice and data dispatch software.

Elcomplus SmartPPT SCADA Server

Titel

Elcomplus SmartPPT SCADA Server

Veröffentlicht

19. April 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-109-05

Text

Multiple RTOS (Update E)

Titel

Multiple RTOS (Update E)

Veröffentlicht

19. April 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04

Text

This updated advisory is a follow-up to the advisory update titled ICSA-21-119-04 Multiple RTOS (Update D) that was published November 30, 2021, to the ICS webpage on www.cisa.gov/uscert. CISA is aware of a public report, known as “BadAlloc” that details vulnerabilities found in multiple real-time operating systems (RTOS) and supporting ...

15.04.2022

Siemens RUGGEDCOM Devices (Update A)

Titel

Siemens RUGGEDCOM Devices (Update A)

Veröffentlicht

15. April 2022 04:46

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-069-01

Text

This updated advisory is a follow-up to the original advisory titled ICSA-22-069-01 Siemens RUGGEDCOM Devices that was published March 10, 2022, to the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for a Missing Encryption of Sensitive Data vulnerability in devices using the Siemens RUGGEDCOM software platform.

14.04.2022

Delta Electronics DMARS

Titel

Delta Electronics DMARS

Veröffentlicht

14. April 2022 17:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-104-01

Text

This advisory contains mitigations for an Improper Restriction of XML External Entity Reference vulnerability in the Delta Electronics DMARS program development tool.

14.04.2022