April 2022
12.04.2022
SIEMENS CERT
SSA-102233 V1.8 (Last Update: 2022-04-12): SegmentSmack in VxWorks-based Industrial Devices
Title
SSA-102233 V1.8 (Last Update: 2022-04-12): SegmentSmack in VxWorks-based Industrial Devices
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-102233.pdf
Summary
The products listed below contain a vulnerability that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released an update ...
12.04.2022
SIEMENS CERT
SSA-998762 V1.0: File Parsing Vulnerabilities in Simcenter Femap before V2022.1.2
Title
SSA-998762 V1.0: File Parsing Vulnerabilities in Simcenter Femap before V2022.1.2
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-998762.pdf
Summary
Siemens Simcenter Femap versions before V2022.1.2 are affected by vulnerabilities that could be triggered when the application reads files in .NEU format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform remote code ...
12.04.2022
SIEMENS CERT
SSA-870917 V1.0: Improper Access Control Vulnerability in Mendix
Title
SSA-870917 V1.0: Improper Access Control Vulnerability in Mendix
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf
Summary
When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field. Siemens has released updates for the affected products and recommends to update to the latest versions.
12.04.2022
SIEMENS CERT
SSA-836527 V1.0: Multiple Vulnerabilities in SCALANCE X-300 Switch Family Devices
Title
SSA-836527 V1.0: Multiple Vulnerabilities in SCALANCE X-300 Switch Family Devices
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-836527.pdf
Summary
Several SCALANCE X-300 switches contain multiple vulnerabilities. An unauthenticated attacker could reboot, cause denial of service conditions and potentially impact the system by other means through heap and buffer overflow vulnerabilities. Siemens has released updates for the affected products and recommends to update to the latest versions.
12.04.2022
SIEMENS CERT
SSA-711829 V1.0: Denial of Service Vulnerability in TIA Administrator
Title
SSA-711829 V1.0: Denial of Service Vulnerability in TIA Administrator
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-711829.pdf
Summary
In conjunction with the installation of the affected products listed in the table below, a vulnerability in TIA Administrator occurs that could allow an unauthenticated attacker to perform a denial of service attack. Siemens has released a first update for one of the affected products and recommends to update to ...
12.04.2022
SIEMENS CERT
SSA-655554 V1.0: Multiple Vulnerabilities in SIMATIC Energy Manager before V7.3 Update 1
Title
SSA-655554 V1.0: Multiple Vulnerabilities in SIMATIC Energy Manager before V7.3 Update 1
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf
Summary
SIMATIC Energy Manager is affected by multiple vulnerabilities that could allow an attacker to gain local privilege escalation, local code execution or remote code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.
12.04.2022
SIEMENS CERT
SSA-557541 V1.0: Denial-of-Service Vulnerability in SIMATIC S7-400 CPUs
Title
SSA-557541 V1.0: Denial-of-Service Vulnerability in SIMATIC S7-400 CPUs
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-557541.pdf
Summary
SIMATIC S7-400 CPU devices contain an input validation vulnerability that could allow an attacker to create a Denial-of-Service condition. A restart is needed to restore normal operations. Siemens has released an update for SIMATIC S7-410 V10 CPU family and SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants for both) ...
12.04.2022
SIEMENS CERT
SSA-446448 V1.0: Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Title
SSA-446448 V1.0: Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-446448.pdf
Summary
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, contains a vulnerability that could allow an attacker to cause a denial of service condition on affected industrial products. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further ...
12.04.2022
SIEMENS CERT
SSA-414513 V1.0: Information Disclosure Vulnerability in Mendix
Title
SSA-414513 V1.0: Information Disclosure Vulnerability in Mendix
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-414513.pdf
Summary
An information disclosure vulnerability in Mendix applications was discovered. The vulnerability could allow to read sensitive data. Siemens has released an update for the Mendix Applications using Mendix 9 and recommends to update to the latest version. Siemens recommends countermeasures for products where updates are not, or not yet available.
12.04.2022
SIEMENS CERT
SSA-392912 V1.0: Multiple Denial Of Service Vulnerabilities in SCALANCE W1700 Devices
Title
SSA-392912 V1.0: Multiple Denial Of Service Vulnerabilities in SCALANCE W1700 Devices
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf
Summary
Vulnerabilities have been identified in devices of the SCALANCE W-1700 (11ac) family that could allow an attacker to cause various denial of service conditions. Siemens has released updates for the affected products and recommends to update to the latest versions.
12.04.2022
SIEMENS CERT
SSA-350757 V1.0: Improper Access Control Vulnerability in TIA Portal Affecting S7-1200 and S7-1500 CPUs Web Server (Incl. Relat...
Title
SSA-350757 V1.0: Improper Access Control Vulnerability in TIA Portal Affecting S7-1200 and S7-1500 CPUs Web Server (Incl. Related ET200 CPUs and SIPLUS variants)
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-350757.pdf
Summary
An attacker could achieve privilege escalation on the web server of certain devices configured by SIMATIC STEP 7 (TIA Portal) due to incorrect handling of the webserver’s user management configuration during downloading. This only affects the S7-1200 and S7-1500 CPUs’ (incl. related ET200 CPUs and SIPLUS variants) web server, when ...
12.04.2022
SIEMENS CERT
SSA-316850 V1.0: Unauthenticated File Access in SICAM A8000 Devices
Title
SSA-316850 V1.0: Unauthenticated File Access in SICAM A8000 Devices
Published
April 12, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-316850.pdf
Summary
SICAM A8000 CP-8050 and CP-8031 devices contain vulnerabilities that could allow an attacker to access files without authentication. Siemens has released updates for the affected products and recommends to update to the latest versions.
07.04.2022
US CERT (ICS)
Pepperl+Fuchs WirelessHART-Gateway
Title
Pepperl+Fuchs WirelessHART-Gateway
Published
April 7, 2022, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-097-01
Summary
This advisory contains mitigations for several vulnerabilities in Pepperl+Fuchs WirelessHART-Gateway industrial networking devices.
07.04.2022
US CERT (ICS)
ABB SPIET800 and PNI800
Title
ABB SPIET800 and PNI800
Published
April 7, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-097-02
Summary
This advisory contains mitigations for Incomplete Internal State Distinction, Improper Handling of Unexpected Data Type, and Uncontrolled Resource Consumption vulnerabilities in ABB Symphony Plus SPIET800 and PNI800 network interface modules.
05.04.2022
US CERT (ICS)
LifePoint Informatics Patient Portal
Title
LifePoint Informatics Patient Portal
Published
April 5, 2022, 4:15 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsma-22-095-01
Summary
This advisory contains mitigations for an Authentication Bypass Using Alternate Path or Channel vulnerability in the LifePoint Informatics Patient Portal, a website containing patient health data.
05.04.2022
US CERT (ICS)
Philips Vue PACS (Update B)
Title
Philips Vue PACS (Update B)
Published
April 5, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsma-21-187-01
Summary
This updated advisory is a follow-up to the advisory update titled ICSMA-21-87-01 Philips Vue PACS (Update A) that was published January 20, 2022, to the ICS webpage on www.cisa.gov/uscert/ics. This advisory contains mitigations for numerous vulnerabilities in Philips Vue PACS products.
March 2022
31.03.2022
US CERT (ICS)
Schneider Electric SCADAPack Workbench
Title
Schneider Electric SCADAPack Workbench
Published
March 31, 2022, 4:40 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-090-01
Summary
This advisory contains mitigations for an Improper Restriction of XML External Entity Reference vulnerability in Schneider Electric SCADAPack Workbench software.
31.03.2022
US CERT (ICS)
Hitachi Energy e-mesh EMS
Title
Hitachi Energy e-mesh EMS
Published
March 31, 2022, 4:35 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-090-02
Summary
This advisory contains mitigations for Improper Restriction of Operations Within the Bounds of a Memory Buffer, Use After Free, and Uncontrolled Resource Consumption vulnerabilities in Hitachi Energy e-mesh EMS, an optimizer software for energy resources.
31.03.2022
US CERT (ICS)
Fuji Electric Alpha5
Title
Fuji Electric Alpha5
Published
March 31, 2022, 4:30 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-090-03
Summary
This advisory contains mitigations for Access of Uninitialized Pointer, Out-of-bound Read, Stack-based Buffer Overflow, and Heap-based Buffer Overflow vulnerabilities in the Fuji Electric Alpha5 servo drive system.
31.03.2022
US CERT (ICS)
Mitsubishi Electric FA Products
Title
Mitsubishi Electric FA Products
Published
March 31, 2022, 4:25 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-090-04
Summary
This advisory contains mitigations for a Use of Password Hash Instead of Password for Authentication, Use of Weak Hash, Cleartext Storage of Sensitive Information, and Authentication Bypass by Capture-replay vulnerabilities in Mitsubishi Electric FA CPU module products.
31.03.2022
US CERT (ICS)
General Electric Renewable Energy MDS Radios
Title
General Electric Renewable Energy MDS Radios
Published
March 31, 2022, 4:15 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-090-06
Summary
This advisory contains mitigations for Improper Input Validation, Hidden Functionality, Inadequate Encryption Strength, Uncontrolled Resource Consumption, Plaintext Storage of a Password, and Download of Code Without Integrity Check vulnerabilities in General Electric Renewable Energy MDS Radios.
31.03.2022
US CERT (ICS)
Rockwell Automation Studio 5000 Logix Designer
Title
Rockwell Automation Studio 5000 Logix Designer
Published
March 31, 2022, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-090-07
Summary
This advisory contains mitigations for a Code Injection vulnerability in Rockwell Automation Studio 5000 Logix Designer design configuration hardware.
31.03.2022
US CERT (ICS)
PTC Axeda agent and Axeda Desktop Server (Update C)
Title
PTC Axeda agent and Axeda Desktop Server (Update C)
Published
March 31, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-067-01
Summary
This updated advisory is a follow-up to the advisory update titled ICSA-22-067-01 PTC Axeda agent and Axeda Desktop Server (Update B) that was published March 15, 2022, on the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for Use of Hard-coded Credentials, Missing Authentication for Critical Function, Exposure of Sensitive ...
31.03.2022
US CERT (ICS)
Mitsubishi Electric MELSEC iQ-R, Q and L Series (Update C)
Title
Mitsubishi Electric MELSEC iQ-R, Q and L Series (Update C)
Published
March 31, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-20-303-01
Summary
This updated advisory is a follow-up to the advisory update ICSA-20-303-01 Mitsubishi Electric MELSEC iQ-R, Q and L Series (Update B) that was published January 13, 2022, to the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for an Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric's MELSEC iQ-R, Q and ...
30.03.2022
BOSCH PSIRT
Buffer Overflow Vulnerability in Recovery Image
Title
Buffer Overflow Vulnerability in Recovery Image
Published
March 30, 2022, 2 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-446276-bt.html
Summary

BOSCH-SA-446276-BT: A recently discovered security vulnerability allows an attacker to cause an buffer overflow in the recovery image, crashing the application and open the possibility for code execution.The recovery image can only be booted using a command requiring administrative access or requiring physical access to the device.Bosch rates this vulnerability ...

Last Updates

BOSCH PSIRT
31.10.2024
SIEMENS CERT
22.11.2024
US CERT
08.11.2024
US CERT (ICS)
21.11.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds