Bulletins | CERT@VDE

https://www.us-cert.gov/ics/advisories/icsa-20-119-01

LCDS LAquis SCADA

Titel

LCDS LAquis SCADA

Veröffentlicht

28. April 2020 16:00

URL

Text

This advisory contains mitigations for exposure of sensitive information to an unauthorized actor, and improper input validation vulnerabilities in LCDS's LAquis SCADA software.

23.04.2020

Sierra Wireless AirLink ALEOS (Update B)

Titel

Sierra Wireless AirLink ALEOS (Update B)

Veröffentlicht

23. April 2020 16:00

URL

https://www.us-cert.gov/ics/advisories/ICSA-19-122-03

Text

This updated advisory is a follow-up to the original advisory titled ICSA-19-122-03 Sierra Wireless AirLink ALEOS (Update A) that was published August 20, 2019, to the ICS webpage on us-cert.gov. This updated advisory includes mitigations for OS command injection, use of hard-coded credentials, unrestricted upload of file with dangerous type, ...

21.04.2020

Inductive Automation Ignition

Titel

Inductive Automation Ignition

Veröffentlicht

21. April 2020 16:00

URL

https://www.us-cert.gov/ics/advisories/icsa-20-112-01

Text

This advisory contains mitigations for an improper access control vulnerability in Inductive Automation's Ignition 8 Gateway web server software.

https://www.us-cert.gov/ics/advisories/icsa-20-105-01

Eaton HMiSoft VU3

Titel

Eaton HMiSoft VU3

Veröffentlicht

14. April 2020 17:05

URL

Text

This advisory contains mitigations for stack-based buffer overflow and out-of-bounds read vulnerabilities in Eaton's HMiSoft VU3 human-machine interface (HMI).

Triangle MicroWorks DNP3 Outstation Libraries

Titel

Triangle MicroWorks DNP3 Outstation Libraries

Veröffentlicht

14. April 2020 17:00

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-02

Text

This advisory contains mitigations for a stack-based buffer overflow vulnerability in Triangle MicroWorks DNP3 components and source code libraries.

Triangle MicroWorks SCADA Data Gateway

Titel

Triangle MicroWorks SCADA Data Gateway

Veröffentlicht

14. April 2020 16:55

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-03

Text

This advisory contains mitigations for stack-based buffer overflow, out-of-bounds read, and type confusion vulnerabilities in the Triangle MicroWorks SCADA Data Gateway.

https://www.us-cert.gov/ics/advisories/icsa-20-105-04

Siemens Climatix

Titel

Siemens Climatix

Veröffentlicht

14. April 2020 16:50

URL

Text

This advisory contains mitigations for cross-site scripting and basic XSS vulnerabilities in Siemens Climatix controllers.

Siemens IE/PB-Link, RUGGEDCOM, SCALANCE, SIMATIC, SINEMA

Titel

Siemens IE/PB-Link, RUGGEDCOM, SCALANCE, SIMATIC, SINEMA

Veröffentlicht

14. April 2020 16:45

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-05

Text

This advisory contains mitigations for uncontrolled resource consumption and improper input validation vulnerabilities in Siemens IE/PB-Link, RUGGEDCOM, SCALANCE, SIMATIC, and SINEMA products.

Siemens SIMOTICS, Desigo, APOGEE, and TALON

Titel

Siemens SIMOTICS, Desigo, APOGEE, and TALON

Veröffentlicht

14. April 2020 16:40

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-06

Text

This advisory contains mitigations for a business logic errors vulnerability in Siemens' SIMOTICS, Desigo, APOGEE, and TALON products.

Siemens SCALANCE & SIMATIC

Titel

Siemens SCALANCE & SIMATIC

Veröffentlicht

14. April 2020 16:35

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-07

Text

This advisory contains mitigations for a resource exhaustion vulnerability in Siemens' SCALANCE and SIMATIC products.

Siemens KTK, SIDOOR, SIMATIC, and SINAMICS

Titel

Siemens KTK, SIDOOR, SIMATIC, and SINAMICS

Veröffentlicht

14. April 2020 16:30

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-08

Text

This advisory contains mitigations for an uncontrolled resource consumption vulnerability in Siemens' KTN, SIDOOR, SIMATIC, and SINAMICS products.

Siemens TIM 3V-IE and 4R-IE Family Devices

Titel

Siemens TIM 3V-IE and 4R-IE Family Devices

Veröffentlicht

14. April 2020 16:25

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-09

Text

This advisory contains mitigations for an active debug code vulnerability in Siemens TIM 3V-IE and 4R-IE Family Devices.

Siemens SIMATIC S7 (Update B)

Titel

Siemens SIMATIC S7 (Update B)

Veröffentlicht

14. April 2020 16:20

URL

https://www.us-cert.gov/ics/advisories/icsa-20-042-05

Text

This updated advisory is a follow-up to the advisory update titled ICSA-20-042-05 Siemens SIMATIC S7 (Update A) that was published March 10, 2020, to the ICS webpage on us-cert.gov. This advisory contains mitigations for a resource exhaustion vulnerability in Siemens SIMATIC S7 devices.

Advantech WebAccess/NMS

Titel

Advantech WebAccess/NMS

Veröffentlicht

7. April 2020 16:25

URL

https://www.us-cert.gov/ics/advisories/icsa-20-098-01

Text

This advisory contains mitigations for multiple vulnerabilities in Advantech's WebAccess/NMS network management system.

GE Digital CIMPLICITY

Titel

GE Digital CIMPLICITY

Veröffentlicht

7. April 2020 16:20

URL

https://www.us-cert.gov/ics/advisories/icsa-20-098-02

Text

This advisory contains mitigations for a privilege escalation vulnerability in GE Digital CIMPLICITY HMI/SCADA products.

HMS Networks eWON Flexy and Cosy

Titel

HMS Networks eWON Flexy and Cosy

Veröffentlicht

7. April 2020 16:15

URL

https://www.us-cert.gov/ics/advisories/icsa-20-098-03

Text

This advisory contains mitigations for a cross-site scripting vulnerability in HMS Networks eWON Flexy and Cosy Industrial VPN routers.

https://www.us-cert.gov/ics/advisories/icsa-20-098-05

KUKA.Sim Pro

Titel

KUKA.Sim Pro

Veröffentlicht

7. April 2020 16:05

URL

Text

This advisory contains mitigations for a ### vulnerability in ###, a ###

Synergy Systems & Solutions HUSKY RTU (Update A)

Titel

Synergy Systems & Solutions HUSKY RTU (Update A)

Veröffentlicht

7. April 2020 16:00

URL

https://www.us-cert.gov/ics/advisories/icsa-20-042-01

Text

This updated advisory is a follow-up to the original advisory titled ICSA-20-042-01 Synergy Systems & Solutions HUSKY RTU that was published February 11, 2020, to the ICS webpage on us-cert.gov. This advisory contains mitigations for improper authentication and improper input validation vulnerabilities in Synergy Systems & Solutions HUSKY RTU, a ...

02.04.2020

B&R Automation Studio

Titel

B&R Automation Studio

Veröffentlicht

2. April 2020 16:00

URL

https://www.us-cert.gov/ics/advisories/icsa-20-093-01

Text

This advisory contains mitigations for improper privilege management, missing required cryptographic step, and path traversal vulnerabilities in B&R Automation Studio software.

März 2020

BD Pyxis MedStation and Pyxis Anesthesia (PAS) ES System

Titel

BD Pyxis MedStation and Pyxis Anesthesia (PAS) ES System

Veröffentlicht

31. März 2020 16:15

URL

https://www.us-cert.gov/ics/advisories/icsma-20-091-01

Text

This advisory contains mitigations for a protection mechanism failure vulnerability in BD Pyxis medical devices.

Hirschmann Automation and Control HiOS and HiSecOS Products

Titel

Hirschmann Automation and Control HiOS and HiSecOS Products

Veröffentlicht

31. März 2020 16:10

URL

https://www.us-cert.gov/ics/advisories/icsa-20-091-01

Text

This advisory contains mitigations for a classic buffer overflow vulnerability in Hirschmann Automation and Control HiOS and HiSecOS software.

Mitsubishi Electric MELSEC

Titel

Mitsubishi Electric MELSEC

Veröffentlicht

31. März 2020 16:05

URL

https://www.us-cert.gov/ics/advisories/icsa-20-091-02

Text

This advisory contains mitigations for an uncontrolled resource consumption vulnerability in Mitsubishi Electric MELSEC programmable controllers.

Schneider Electric Modicon Controllers (Update A)

Titel

Schneider Electric Modicon Controllers (Update A)

Veröffentlicht

31. März 2020 16:00

URL

https://www.us-cert.gov/ics/advisories/icsa-20-016-01

Text

This updated advisory is a follow-up to the original advisory titled ICSA-20-016-01 Schneider Electric Modicon Controllers that was published January 16, 2020, to the ICS webpage on us-cert.gov. This advisory contains mitigations for several improper check for unusual or exceptional conditions vulnerabilities in Schneider Electric Modicon PLC controllers.

24.03.2020