Bulletins | CERT@VDE

https://www.us-cert.gov/ics/advisories/icsa-19-211-01

Wind River VxWorks

Title

Wind River VxWorks

Published

July 30, 2019, 4:05 p.m.

URL

Summary

This advisory includes mitigations for stack-based buffer overflow, heap-based buffer overflow, integer underflow, improper restriction of operations within the bounds of a memory buffer, race condition, argument condition or modification, null pointer dereference, and argument injection or modification vulnerabilities reported in Wind River’s VxWorks.

30.07.2019

Prima Systems FlexAir

Title

Prima Systems FlexAir

Published

July 30, 2019, 4 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-211-02

Summary

This advisory includes mitigations for OS command Injection, unrestricted upload of file with dangerous type, sross-site request forgery, small space of random values, cross-site scripting, exposure of backup file to unauthorized control sphere, improper authentication, and use of hard-coded credentials vulnerabilities reported in Prima Systems' FlexAir access control platform.

30.07.2019

CAN Bus Network Implementation in Avionics

Title

CAN Bus Network Implementation in Avionics

Published

July 30, 2019, 3 p.m.

URL

https://www.us-cert.gov/ics/alerts/ics-alert-19-211-01

Summary

CISA is aware of a public report of insecure implementation of CAN bus networks affecting aircraft. According to this report, the CAN bus networks are exploitable when an attacker has unsupervised physical access to the aircraft. CISA is issuing this alert to provide early notice of the report.

23.07.2019

Mitsubishi Electric FR Configurator2

Title

Mitsubishi Electric FR Configurator2

Published

July 23, 2019, 4:05 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-204-01

Summary

This advisory contains mitigation details for improper restriction of XML external entity reference and uncontrolled resource consumption vulnerabilities in Mitsubishi Electric's FR Configurator variable frequency drives.

23.07.2019

https://www.us-cert.gov/ics/advisories/icsa-19-204-02

NREL EnergyPlus

Title

NREL EnergyPlus

Published

July 23, 2019, 4 p.m.

URL

Summary

This advisory includes mitigations for a stack-based buffer overflow vulnerability in the NREL EnergyPlus software.

16.07.2019

Johnson Controls exacqVision Server

Title

Johnson Controls exacqVision Server

Published

July 16, 2019, 10:37 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-199-01

Summary

This advisory includes mitigations for an unquoted search path or element vulnerability reported in the Johnson Controls exacqVision Server.

Philips Holter 2010 Plus

Title

Philips Holter 2010 Plus

Published

July 11, 2019, 4:35 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsma-19-192-01

Summary

This advisory provides information about, and mitigations for, a vulnerability reported in the Philips Holter 2010 Plus.

Delta Industrial Automation CNCSoft ScreenEditor

Title

Delta Industrial Automation CNCSoft ScreenEditor

Published

July 11, 2019, 4:30 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-192-01

Summary

This advisory includes mitigations for heap-based buffer overflow and out-of-bounds read vulnerabilities reported in the Delta Electronics CNCSoft ScreenEditor.

Siemens SIMATIC WinCC and PCS7

Title

Siemens SIMATIC WinCC and PCS7

Published

July 11, 2019, 4:25 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-192-02

Summary

This advisory includes mitigations for an unrestricted upload of file with dangerous type vulnerability reported in the Siemens SIMATIC WinCC and SIMATIC PCS7 industrial products.

Siemens TIA Administrator (TIA Portal)

Title

Siemens TIA Administrator (TIA Portal)

Published

July 11, 2019, 4:20 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-192-03

Summary

This advisory provides information about, and mitigations for, a vulnerability in the Siemens TIA Administrator (TIA Portal) application.

Siemens SIMATIC RF6XXR

Title

Siemens SIMATIC RF6XXR

Published

July 11, 2019, 4:15 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-192-04

Summary

This advisory provides information about, and mitigations for, several vulnerabilities in the Siemens SIMATIC RF6XXR series devices.

AVEVA Vijeo Citect and Citect SCADA Floating License Manager

Title

AVEVA Vijeo Citect and Citect SCADA Floating License Manager

Published

July 11, 2019, 4:10 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-192-05

Summary

This advisory provides information about, and mitigations for, several vulnerabilities reported in the AVEVA Vijeo Citect and Citect SCADA Floating License Manager applications.

Schneider Electric Interactive Graphical SCADA System

Title

Schneider Electric Interactive Graphical SCADA System

Published

July 11, 2019, 4:05 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-19-192-06

Summary

This advisory includes mitigations for an out-of-bounds write vulnerability in the Schneider Electric Interactive Graphical SCADA System software.

SSA-307392 (Last Update: 2019-07-09): Denial-of-Service in OPC UA in Industrial Products

Title

SSA-307392 (Last Update: 2019-07-09): Denial-of-Service in OPC UA in Industrial Products

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf

Summary

A vulnerability has been identified in the OPC UA server of several industrial products. The vulnerability could cause a Denial-of-Service condition on the service or the device. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and ...

SSA-616199 (Last Update: 2019-07-09): BlueKeep Vulnerability Identified in RAPIDPoint® 500 Operating on Windows XP

Title

SSA-616199 (Last Update: 2019-07-09): BlueKeep Vulnerability Identified in RAPIDPoint® 500 Operating on Windows XP

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf

Summary

Microsoft has released updates for several versions of Microsoft Windows, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network. RAPIDPoint® 500 systems operating on Windows ...

SSA-747162 (Last Update: 2019-07-09): Cross-Site Scripting Vulnerability in Spectrum Power™

Title

SSA-747162 (Last Update: 2019-07-09): Cross-Site Scripting Vulnerability in Spectrum Power™

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-747162.pdf

Summary

A Cross-Site Scripting (XSS) vulnerability was found in the WebSDK component of Spectrum Power™ 3, 4, 5 and 7. A software update is available to address the issue and Siemens recommends installing the patch.

SSA-480230 (Last Update: 2019-07-09): Denial-of-Service in Webserver of Industrial Products

Title

SSA-480230 (Last Update: 2019-07-09): Denial-of-Service in Webserver of Industrial Products

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf

Summary

A vulnerability in the affected devices could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial-of-service attack. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and recommends ...

SSA-721298 (Last Update: 2019-07-09): Missing Authentication Vulnerability in TIA Administrator (TIA Portal)

Title

SSA-721298 (Last Update: 2019-07-09): Missing Authentication Vulnerability in TIA Administrator (TIA Portal)

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-721298.pdf

Summary

The latest update for TIA Administrator (TIA Portal) fixes a vulnerability that could allow local users to execute arbitary application commands without proper authentication. Siemens has released an update for the affected software and provides workarounds and mitigations until the update can be applied.

SSA-166360 (Last Update: 2019-07-09): Vulnerability in Advanced Therapy Products from Siemens Healthineers

Title

SSA-166360 (Last Update: 2019-07-09): Vulnerability in Advanced Therapy Products from Siemens Healthineers

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf

Summary

SSA-899560 (Last Update: 2019-07-09): Vulnerabilities in SIPROTEC 5 relays and DIGSI 5

Title

SSA-899560 (Last Update: 2019-07-09): Vulnerabilities in SIPROTEC 5 relays and DIGSI 5

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-899560.pdf

Summary

The SIPROTEC 5 relays and their corresponding engineering software DIGSI 5 are affected by two security vulnerabilities which could allow an attacker to upload or download files to the device or to conduct a Denial-of-Service attack over the network. Siemens has released updates for some affected products, is working on ...

SSA-832947 (Last Update: 2019-07-09): Vulnerability in Laboratory Diagnostics Products from Siemens Healthineers

Title

SSA-832947 (Last Update: 2019-07-09): Vulnerability in Laboratory Diagnostics Products from Siemens Healthineers

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf

Summary

SSA-697412 (Last Update: 2019-07-09): Multiple Vulnerabilities in SIMATIC WinCC, SIMATIC WinCC Runtime, SIMATIC PCS 7, SIMATIC ...

Title

SSA-697412 (Last Update: 2019-07-09): Multiple Vulnerabilities in SIMATIC WinCC, SIMATIC WinCC Runtime, SIMATIC PCS 7, SIMATIC TIA Portal

Published

July 9, 2019, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf

Summary

The latest update for SIMATIC WinCC fixes multiple vulnerabilities. The most severe could allow an attacker to execute arbitrary commands on an affected system under certain conditions. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and ...