Bulletins | CERT@VDE

Rockwell Automation 1756-L8zS3 and 1756-L3zS3

Titel

Rockwell Automation 1756-L8zS3 and 1756-L3zS3

Veröffentlicht

4. Februar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: 1756-L8zS3, 1756-L3zS3 Vulnerability: Improper Handling of Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote, non-privileged user to send malicious requests resulting in a major nonrecoverable fault causing ...

04.02.2025

AutomationDirect C-more EA9 HMI

Titel

AutomationDirect C-more EA9 HMI

Veröffentlicht

4. Februar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-08

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: AutomationDirect Equipment: C-more EA9 HMI Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition or achieve remote ...

04.02.2025

Schneider Electric Pro-face GP-Pro EX and Remote HMI

Titel

Schneider Electric Pro-face GP-Pro EX and Remote HMI

Veröffentlicht

4. Februar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.1 ATTENTION: Exploitable remotely Vendor: Schneider Electric Equipment: Pro-face GP-Pro EX and Remote HMI Vulnerability: Improper Enforcement of Message Integrity During Transmission in a Communication Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could allow man-in-the-middle attacks, resulting in information disclosure, integrity ...

Januar 2025

Rockwell Automation FactoryTalk AssetCentre

Titel

Rockwell Automation FactoryTalk AssetCentre

Veröffentlicht

30. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk AssetCentre Vulnerabilities: Inadequate Encryption Strength, Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to extract passwords, access, credentials, or impersonate other users. 3. TECHNICAL DETAILS ...

Schneider Electric System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs

Titel

Schneider Electric System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs

Veröffentlicht

30. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Harmony Industrial PC, Pro-face Industrial PC Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access sensitive information. 3. TECHNICAL ...

New Rock Technologies Cloud Connected Devices

Titel

New Rock Technologies Cloud Connected Devices

Veröffentlicht

30. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: New Rock Technologies Equipment: Cloud Connected Devices Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Neutralization of Wildcards or Matching Symbols 2. RISK EVALUATION Successful exploitation of these vulnerabilities ...

Rockwell Automation KEPServer

Titel

Rockwell Automation KEPServer

Veröffentlicht

30. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: KEPServer Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability could cause the device to crash. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell Automation's KEPServer are ...

28.01.2025

Schneider Electric Power Logic

Titel

Schneider Electric Power Logic

Veröffentlicht

28. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Power Logic Vulnerabilities: Authorization Bypass Through User-Controlled Key, Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to modify ...

28.01.2025

Schneider Electric RemoteConnect and SCADAPack x70 Utilities

Titel

Schneider Electric RemoteConnect and SCADAPack x70 Utilities

Veröffentlicht

28. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low Attack Complexity Vendor: Schneider Electric Equipment: Electric RemoteConnect and SCADAPack x70 Utilities Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to loss of confidentiality, integrity, and potential remote code execution on workstation when ...

28.01.2025

B&R Automation Runtime

Titel

B&R Automation Runtime

Veröffentlicht

28. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: B&R Equipment: Automation Runtime Vulnerability: Use of a Broken or Risky Cryptographic Algorithm 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to masquerade as legitimate services on impacted devices. 3. TECHNICAL DETAILS ...

Schneider Electric EcoStruxure Power Build Rapsody

Titel

Schneider Electric EcoStruxure Power Build Rapsody

Veröffentlicht

23. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 4.6 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: EcoStruxure Power Build Rapsody Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of this vulnerability could allow local attackers to potentially execute arbitrary code when ...

Schneider Electric EVlink Home Smart and Schneider Charge

Titel

Schneider Electric EVlink Home Smart and Schneider Charge

Veröffentlicht

23. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: EVlink Home Smart and Schneider Charge Vulnerability: Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability may expose test credentials in the firmware binary. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...

HMS Networks Ewon Flexy 202

Titel

HMS Networks Ewon Flexy 202

Veröffentlicht

23. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Low attack complexity Vendor: HMS Networks Equipment: Ewon Flexy 202 Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to disclose sensitive user credentials. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following ...

Hitachi Energy RTU500 Series Product

Titel

Hitachi Energy RTU500 Series Product

Veröffentlicht

23. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: RTU500 series products Vulnerability: Improperly Implemented Security Check for Standard 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to to update the RTU500 with unsigned firmware. 3. TECHNICAL DETAILS ...

21.01.2025

ZF Roll Stability Support Plus (RSSPlus)

Titel

ZF Roll Stability Support Plus (RSSPlus)

Veröffentlicht

21. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable from an adjacent network/low attack complexity Vendor: ZF Equipment: RSSPlus Vulnerability: Authentication Bypass By Primary Weakness 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to remotely (proximal/adjacent with RF equipment) call diagnostic functions which could ...

21.01.2025

Siemens SIMATIC S7-1200 CPUs

Titel

Siemens SIMATIC S7-1200 CPUs

Veröffentlicht

21. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-02

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

21.01.2025

Traffic Alert and Collision Avoidance System (TCAS) II

Titel

Traffic Alert and Collision Avoidance System (TCAS) II

Veröffentlicht

21. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Exploitable from adjacent network Standard: Traffic Alert and Collision Avoidance System (TCAS) II Equipment: Collision Avoidance Systems Vulnerabilities: Reliance on Untrusted Inputs in a Security Decision, External Control of System or Configuration Setting 2. RISK EVALUATION Successful exploitation of these vulnerabilities ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-01

Siemens Mendix LDAP

Titel

Siemens Mendix LDAP

Veröffentlicht

16. Januar 2025 13:00

URL

Text

Hitachi Energy FOX61x, FOXCST, and FOXMAN-UN Products

Titel

Hitachi Energy FOX61x, FOXCST, and FOXMAN-UN Products

Veröffentlicht

16. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 4.9 ATTENTION: Low attack complexity Vendor: Hitachi Energy Equipment: FOX61x, FOXCST, FOXMAN-UN Vulnerability: Improper Validation of Certificate with Host Mismatch 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to intercept or falsify data exchanges between the client and the server. ...

Fuji Electric Alpha5 SMART

Titel

Fuji Electric Alpha5 SMART

Veröffentlicht

16. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Fuji Electric Equipment: Alpha5 SMART Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Fuji Electric ...

Hitachi Energy FOX61x Products

Titel

Hitachi Energy FOX61x Products

Veröffentlicht

16. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 4.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: FOX61x Products Vulnerability: Relative Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to traverse the file system to access files or directories that would otherwise be inaccessible. ...

Siemens SIPROTEC 5 Products

Titel

Siemens SIPROTEC 5 Products

Veröffentlicht

16. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-04

Text

14.01.2025

Belledonne Communications Linphone-Desktop

Titel

Belledonne Communications Linphone-Desktop

Veröffentlicht

14. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-014-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Belledonne Communications Equipment: Linphone-Desktop Vulnerability: NULL Pointer Dereference 2. RISK EVALUATION Successful exploitation of this vulnerability could could result in a remote attacker causing a denial-of-service condition on the affected devices. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

14.01.2025

Schneider Electric Vijeo Designer

Titel

Schneider Electric Vijeo Designer

Veröffentlicht

14. Januar 2025 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-014-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low Attack Complexity Vendor: Schneider Electric Equipment: Vijeo Designer Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause a non-admin authenticated user to perform privilege escalation by tampering with the binaries. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

10.01.2025