Bulletins | CERT@VDE

Rockwell Automation AADvance Trusted SIS Workstation

Titel

Rockwell Automation AADvance Trusted SIS Workstation

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-20

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: AADvance Trusted SIS Workstation Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker executing code within the context of a current process. 3. TECHNICAL DETAILS 3.1 ...

12.09.2024

Rockwell Automation FactoryTalk View Site

Titel

Rockwell Automation FactoryTalk View Site

Veröffentlicht

12. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-23

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform unauthenticated remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell ...

10.09.2024

iniNet Solutions SpiderControl SCADA Web Server

Titel

iniNet Solutions SpiderControl SCADA Web Server

Veröffentlicht

10. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: iniNet Solutions GmbH Equipment: SpiderControl SCADA Web Server Vulnerabilities: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to log in or execute arbitrary code. 3. ...

10.09.2024

Rockwell Automation SequenceManager

Titel

Rockwell Automation SequenceManager

Veröffentlicht

10. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: SequenceManager Vulnerabilities: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of SequenceManager, a logix ...

10.09.2024

Viessmann Climate Solutions SE Vitogate 300

Titel

Viessmann Climate Solutions SE Vitogate 300

Veröffentlicht

10. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Viessmann Climate Solutions SE Equipment: Vitogate 300 Vulnerabilities: Use of Hard-coded Credentials, Forced Browsing, Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to achieve remote code execution. ...

05.09.2024

Hughes Network Systems WL3000 Fusion Software

Titel

Hughes Network Systems WL3000 Fusion Software

Veröffentlicht

5. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-249-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: Hughes Network Systems Equipment: WL3000 Fusion Software Vulnerabilities: Insufficiently Protected Credentials, Missing Encryption of Sensitive Data 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to obtain read-only access to network configuration information and ...

03.09.2024

LOYTEC Electronics LINX Series

Titel

LOYTEC Electronics LINX Series

Veröffentlicht

3. September 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: LOYTEC electronics GmbH Equipment: LINX series Vulnerabilities: Cleartext Transmission of Sensitive Information, Missing Authentication for Critical Function, Cleartext Storage of Sensitive Information, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities ...

August 2024

29.08.2024

Delta Electronics DTN Soft

Titel

Delta Electronics DTN Soft

Veröffentlicht

29. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-242-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DTN Soft Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ...

MOBOTIX P3 and Mx6 Cameras

Titel

MOBOTIX P3 and Mx6 Cameras

Veröffentlicht

22. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-03

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: MOBOTIX Equipment: P3 Cameras, Mx6 Cameras Vulnerability: Improper Neutralization of Expression/Command Delimiters 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an authenticated attacker to achieve remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...

Rockwell Automation 5015 - AENFTXT

Titel

Rockwell Automation 5015 - AENFTXT

Veröffentlicht

22. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: 5015 - AENFTXT Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell Automation 5015 ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-04

Avtec Outpost 0810

Titel

Avtec Outpost 0810

Veröffentlicht

22. August 2024 14:00

URL

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Avtec Equipment: Outpost 0810, Outpost Uploader Utility Vulnerability: Storage of File with Sensitive Data Under Web Root, Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain ...

Rockwell Automation Emulate3D

Titel

Rockwell Automation Emulate3D

Veröffentlicht

22. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.4 ATTENTION: Exploitable locally Vendor: Rockwell Automation Equipment: Emulate3D Vulnerability: Externally Controlled Reference to a Resource in Another Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

Siemens LOGO! V8.3 BM Devices

Titel

Siemens LOGO! V8.3 BM Devices

Veröffentlicht

15. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-05

Text

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

PTC Kepware ThingWorx Kepware Server

Titel

PTC Kepware ThingWorx Kepware Server

Veröffentlicht

15. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-11

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable from adjacent network. Vendor: PTC Equipment: Kepware ThingWorx Kepware Server Vulnerability: Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the target device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS PTC reports that ...

AVEVA Historian Web Server

Titel

AVEVA Historian Web Server

Veröffentlicht

15. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-10

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: Historian Server Vulnerability: SQL Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated user to get read and write access to the database. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

Siemens Location Intelligence

Titel

Siemens Location Intelligence

Veröffentlicht

15. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-07

Text

Siemens SCALANCE M-800, RUGGEDCOM RM1224

Titel

Siemens SCALANCE M-800, RUGGEDCOM RM1224

Veröffentlicht

15. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-01

Text

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-02

Siemens INTRALOG WMS

Titel

Siemens INTRALOG WMS

Veröffentlicht

15. August 2024 14:00

URL

Text

Rockwell Automation AADvance Standalone OPC-DA Server

Titel

Rockwell Automation AADvance Standalone OPC-DA Server

Veröffentlicht

13. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-02

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: AADvance Standalone OPC-DA Server Vulnerabilities: Improper Input Validation, Use of Externally Controlled Format String 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code in the affected ...

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380

Titel

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380

Veröffentlicht

13. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-09

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow and attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

AVEVA SuiteLink Server

Titel

AVEVA SuiteLink Server

Veröffentlicht

13. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-01

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: SuiteLink Server Vulnerability: Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause the server to consume excessive system resources, preventing processing of ...

Rockwell Automation DataMosaix Private Cloud

Titel

Rockwell Automation DataMosaix Private Cloud

Veröffentlicht

13. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-05

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: DataMosaix Private Cloud Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to generate cookies for a user ID without the use of a username or password, ...

Rockwell Automation Micro850/870

Titel

Rockwell Automation Micro850/870

Veröffentlicht

13. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-07

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Micro850/870 Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability may cause CIP/Modbus communication to be disrupted for short duration. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Rockwell Automation reports that ...

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380

Titel

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380

Veröffentlicht

13. August 2024 14:00

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-10

Text

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, Compact GuardLogix 5380, CompactLogix 5480 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device being accessed. 3. TECHNICAL DETAILS 3.1 ...