Bulletins | CERT@VDE

Sierra Wireless AirLink with ALEOS firmware

Titel

Sierra Wireless AirLink with ALEOS firmware

Veröffentlicht

7. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-06

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sierra Wireless Equipment: AirLink Vulnerabilities: Infinite Loop, NULL Pointer Dereference, Cross-site Scripting, Reachable Assertion, Use of Hard-coded Credentials, Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to ...

Schweitzer Engineering Laboratories SEL-411L

Titel

Schweitzer Engineering Laboratories SEL-411L

Veröffentlicht

7. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schweitzer Engineering Laboratories Equipment: SEL-411L Vulnerability: Improper Restriction of Rendered UI Layers or Frames 2. RISK EVALUATION Successful exploitation of this vulnerability could expose authorized users to clickjacking attacks. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

Johnson Controls Metasys and Facility Explorer

Titel

Johnson Controls Metasys and Facility Explorer

Veröffentlicht

7. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: Metasys and Facility Explorer Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service by sending invalid credentials. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-05

ControlbyWeb Relay

Titel

ControlbyWeb Relay

Veröffentlicht

7. Dezember 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: ControlByWeb Equipment: X-332 and X-301 Vulnerability: Cross-Site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to run malicious code during a user's session. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

05.12.2023

Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d

Titel

Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d

Veröffentlicht

5. Dezember 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-339-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.4 ATTENTION: Exploitable with adjacent access/low attack complexity Vendor: Zebra Technologies Equipment: ZTC Industrial ZT410, ZTC Desktop GK420d Vulnerability: Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send specially crafted ...

November 2023

30.11.2023

https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-03

PTC KEPServerEx

Titel

PTC KEPServerEx

Veröffentlicht

30. November 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: PTC Equipment: KEPServerEX, ThingWorx, OPC-Aggregator Vulnerabilities: Heap-based Buffer Overflow, Improper Validation of Certificate with Host Mismatch 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker gaining Windows SYSTEM-level code execution on the service ...

30.11.2023

Mitsubishi Electric FA Engineering Software Products

Titel

Mitsubishi Electric FA Engineering Software Products

Veröffentlicht

30. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Mitsubishi Electric Equipment: FA Engineering Software Products Vulnerability: External Control of File Name or Path 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a malicious attacker to execute malicious code by tricking legitimate users to ...

28.11.2023

Franklin Electric Fueling Systems Colibri

Titel

Franklin Electric Fueling Systems Colibri

Veröffentlicht

28. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Franklin Electric Fueling Systems Equipment: Colibri Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain login credentials for other users. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

Siemens OPC UA Modeling Editor (SiOME)

Titel

Siemens OPC UA Modeling Editor (SiOME)

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-07

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens Mendix Runtime

Titel

Siemens Mendix Runtime

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-04

Text

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-12

Siemens PNI

Titel

Siemens PNI

Veröffentlicht

16. November 2023 13:00

URL

Text

Siemens RUGGEDCOM APE1808 Devices

Titel

Siemens RUGGEDCOM APE1808 Devices

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-14

Text

Siemens SIMATIC PCS neo

Titel

Siemens SIMATIC PCS neo

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-06

Text

Siemens Mendix Studio Pro

Titel

Siemens Mendix Studio Pro

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-11

Text

Siemens Desigo CC product family

Titel

Siemens Desigo CC product family

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-03

Text

Siemens SCALANCE Family Products

Titel

Siemens SCALANCE Family Products

Veröffentlicht

16. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-08

Text

https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-01

Red Lion Sixnet RTUs

Titel

Red Lion Sixnet RTUs

Veröffentlicht

16. November 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Red Lion Equipment: Sixnet RTU Vulnerabilities: Authentication Bypass using an Alternative Path or Channel, Exposed Dangerous Method or Function 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to execute commands with ...

14.11.2023

AVEVA Operations Control Logger

Titel

AVEVA Operations Control Logger

Veröffentlicht

14. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: AVEVA Equipment: Operations Control Logger Vulnerabilities: Execution with Unnecessary Privileges, External Control of File Name or Path 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow privilege escalation or denial of service. 3. TECHNICAL DETAILS 3.1 ...

14.11.2023

Rockwell Automation SIS Workstation and ISaGRAF Workbench

Titel

Rockwell Automation SIS Workstation and ISaGRAF Workbench

Veröffentlicht

14. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: SIS Workstation and ISaGRAF Workbench Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unprivileged local users to overwrite files replacing them with malicious programs. 3. TECHNICAL DETAILS 3.1 ...

09.11.2023

Johnson Controls Quantum HD Unity

Titel

Johnson Controls Quantum HD Unity

Veröffentlicht

9. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable Remotely/Low attack complexity Vendor: Johnson Controls Inc. Equipment: Quantum HD Unity Vulnerability: Active Debug Code 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized user to access debug features that were accidentally exposed. 3. TECHNICAL DETAILS 3.1 ...

09.11.2023

https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-02

Hitachi Energy eSOMS

Titel

Hitachi Energy eSOMS

Veröffentlicht

9. November 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: eSOMS Vulnerabilities: Generation of Error Message Containing Sensitive Information, Exposure of Sensitive System Information to an Unauthorized Control Sphere 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose ...

07.11.2023

https://www.cisa.gov/news-events/ics-advisories/icsa-23-311-23

GE MiCOM S1 Agile

Titel

GE MiCOM S1 Agile

Veröffentlicht

7. November 2023 13:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Low attack complexity Vendor: General Electric Equipment: MiCOM S1 Agile Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to upload malicious files and achieve code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...

02.11.2023

Franklin Fueling System TS-550

Titel

Franklin Fueling System TS-550

Veröffentlicht

2. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-04

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Franklin Fueling System Equipment: TS-550 Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access the device and gain unauthenticated ...

02.11.2023

Mitsubishi Electric MELSEC Series

Titel

Mitsubishi Electric MELSEC Series

Veröffentlicht

2. November 2023 13:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Corporation Equipment: MELSEC Series Vulnerability: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability may allow a remote attacker to reset the memory of the products to factory default state ...

02.11.2023