Bulletins | CERT@VDE

Siemens OZW Web Servers

Titel

Siemens OZW Web Servers

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-10

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-11

Siemens Polarion

Titel

Siemens Polarion

Veröffentlicht

15. Mai 2025 14:00

URL

Text

Siemens Mendix OIDC SSO

Titel

Siemens Mendix OIDC SSO

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-15

Text

Siemens VersiCharge AC Series EV Chargers

Titel

Siemens VersiCharge AC Series EV Chargers

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-08

Text

Siemens MS/TP Point Pickup Module

Titel

Siemens MS/TP Point Pickup Module

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-16

Text

ECOVACS DEEBOT Vacuum and Base Station

Titel

ECOVACS DEEBOT Vacuum and Base Station

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: ECOVACS Equipment: DEEBOT Vacuum and Base Station Vulnerabilities: Use of Hard-coded Cryptographic Key, Download of Code Without Integrity Check 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to send malicious updates to ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-07

Siemens IPC RS-828A

Titel

Siemens IPC RS-828A

Veröffentlicht

15. Mai 2025 14:00

URL

Text

Siemens BACnet ATEC Devices

Titel

Siemens BACnet ATEC Devices

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-03

Text

Siemens SIPROTEC and SICAM

Titel

Siemens SIPROTEC and SICAM

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-05

Text

Siemens SIRIUS 3SK2 Safety Relays and 3RK3 Modular Safety Systems

Titel

Siemens SIRIUS 3SK2 Safety Relays and 3RK3 Modular Safety Systems

Veröffentlicht

15. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-13

Text

Hitachi Energy MACH GWS Products

Titel

Hitachi Energy MACH GWS Products

Veröffentlicht

13. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: MACH GWS products Vulnerabilities: Improper Neutralization of Special Elements in Data Query Logic, Improper Limitation of a Pathname to a Restricted Directory, Authentication Bypass by Capture-replay, Missing Authentication for Critical Function 2. RISK ...

ABB Automation Builder

Titel

ABB Automation Builder

Veröffentlicht

13. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: ABB Equipment: Automation Builder Vulnerabilities: Incorrect Permission Assignment for Critical Resource 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to overrule the Automation Builder's user management. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

Hitachi Energy Relion 670/650/SAM600-IO Series

Titel

Hitachi Energy Relion 670/650/SAM600-IO Series

Veröffentlicht

13. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: Hitachi Energy Equipment: Relion 670/650/SAM600-IO Series Vulnerability: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2. RISK EVALUATION Successful exploitation of this vulnerability can allow an attacker to reboot the device and cause a denial-of-service ...

Hitachi Energy Service Suite

Titel

Hitachi Energy Service Suite

Veröffentlicht

13. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Service Suite Vulnerabilities: Use of Less Trusted Source, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Integer Overflow or Wraparound, Out-of-bounds Write, Allocation of Resources Without Limits or Throttling, Exposure of Sensitive Information ...

08.05.2025

Mitsubishi Electric CC-Link IE TSN

Titel

Mitsubishi Electric CC-Link IE TSN

Veröffentlicht

8. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-128-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.2 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Digital Converter module, CC-Link IE TSN Digital-Analog Converter module, CC-Link IE TSN FPGA module, CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY Vulnerability: Improper ...

06.05.2025

https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-03

BrightSign Players

Titel

BrightSign Players

Veröffentlicht

6. Mai 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: BrightSign Equipment: Brightsign Players Vulnerabilities: Execution with Unnecessary Privileges 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for privilege escalation on the device, easily guessed passwords, or for arbitrary code to be executed on ...

06.05.2025

Milesight UG65-868M-EA

Titel

Milesight UG65-868M-EA

Veröffentlicht

6. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Milesight Equipment: UG65-868M-EA Vulnerability: Improper Access Control for Volatile Memory Containing Boot Code 2. RISK EVALUATION Successful exploitation of this vulnerability could allow any user with admin privileges to inject arbitrary shell commands. 3. TECHNICAL DETAILS ...

06.05.2025

Optigo Networks ONS NC600

Titel

Optigo Networks ONS NC600

Veröffentlicht

6. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Optigo Networks Equipment: ONS NC600 Vulnerability: Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to establish an authenticated connection with the hard-coded credentials and perform OS command executions. ...

01.05.2025

KUNBUS GmbH Revolution Pi

Titel

KUNBUS GmbH Revolution Pi

Veröffentlicht

1. Mai 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: KUNBUS Equipment: Revolution Pi Vulnerabilities: Missing Authentication for Critical Function, Authentication Bypass by Primary Weakness, Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers ...

April 2025

ALBEDO Telecom Net.Time - PTP/NTP Clock

Titel

ALBEDO Telecom Net.Time - PTP/NTP Clock

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: ALBEDO Telecom Equipment: Net.Time - PTP/NTP clock Vulnerability: Insufficient Session Expiration 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to ...

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

Titel

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: iSTAR Configuration Utility (ICU) Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Johnson Controls ...

Nice Linear eMerge E3

Titel

Nice Linear eMerge E3

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Nice Equipment: Linear eMerge E3 Vulnerability: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands. ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-05

Johnson Controls ICU

Titel

Johnson Controls ICU

Veröffentlicht

24. April 2025 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: ICU Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Johnson Controls reports the following ...

Planet Technology Network Products

Titel

Planet Technology Network Products

Veröffentlicht

24. April 2025 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Planet Technology Equipment: Planet Technology Network Products Vulnerabilities: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of ...