Bulletins | CERT@VDE

Siemens Mendix SAML Module

Title

Siemens Mendix SAML Module

Published

June 16, 2022, 5 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-04

Summary

This advisory contains mitigations for Improper Restriction of XML External Entity Reference, and Cross-site Scripting vulnerabilities in the Siemens Mendix SAML Module.

Siemens Apache HTTP Server

Title

Siemens Apache HTTP Server

Published

June 16, 2022, 4:56 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-06

Summary

This advisory contains mitigations for NULL Pointer Dereference, Out-of-bounds Write, and Server-side Request Forgery (SSRF) vulnerabilities in the Siemens Apache HTTP Server.

Siemens SICAM GridEdge

Title

Siemens SICAM GridEdge

Published

June 16, 2022, 4:52 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-08

Summary

This advisory contains mitigations for Missing Authentication for Critical Function, and Resource Leak vulnerabilities in the Siemens SICAM GridEdge Essential ARM.

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Title

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Published

June 16, 2022, 4:50 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-09

Summary

This advisory contains mitigations for vulnerabilities in the Siemens SCALANCE LPE9403, a processing power extension for the SCALANCE family of products.

Siemens SCALANCE XM-400 and XR-500

Title

Siemens SCALANCE XM-400 and XR-500

Published

June 16, 2022, 4:48 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-10

Summary

This advisory contains mitigations for an Improper Validation of Integrity Check Value vulnerability in the Siemens SCALANCE XM-400 and XR-500 industrial switches.

Siemens Xpedition Designer

Title

Siemens Xpedition Designer

Published

June 16, 2022, 4:46 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-11

Summary

This advisory contains mitigations for an Incorrect Permission Assignment for Critical Resource vulnerability in the Siemens Xpedition Designer PCB design flow products.

Siemens Spectrum Power Systems

Title

Siemens Spectrum Power Systems

Published

June 16, 2022, 4:44 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-12

Summary

This advisory contains mitigations for a Use of Hard-coded Credentials vulnerability in the Siemens Spectrum Power data modelling and monitoring system.

Siemens OpenSSL Affected Industrial Products

Title

Siemens OpenSSL Affected Industrial Products

Published

June 16, 2022, 4:40 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-167-14

Summary

This advisory contains mitigations for an Infinite Loop vulnerability in the Siemens OpenSSL Affected Industrial Products.

Johnson Controls Metasys ADS ADX OAS Servers

Title

Johnson Controls Metasys ADS ADX OAS Servers

Published

June 14, 2022, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-165-01

Summary

This advisory contains mitigations for Unverified Password Change, and Cross-site Scripting vulnerabilities in the Johnson Controls Metasys ADS ADX OAS Servers.

Meridian Cooperative Meridian

Title

Meridian Cooperative Meridian

Published

June 14, 2022, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-165-02

Summary

This advisory contains mitigations for an Improper Access Control vulnerability in Meridian utility software.

Mitsubishi Electric MELSEC-Q/L and MELSEC iQ-R

Title

Mitsubishi Electric MELSEC-Q/L and MELSEC iQ-R

Published

June 14, 2022, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-165-03

Summary

This advisory contains mitigations for an Improper Input Validation vulnerability in the Mitsubishi Electric MELSEC-Q/L Series and MELSEC iQ-R Series Interface Modules.

SSA-480230 V2.3 (Last Update: 2022-06-14): Denial of service in Webserver of Industrial Products

Title

SSA-480230 V2.3 (Last Update: 2022-06-14): Denial of service in Webserver of Industrial Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf

Summary

A vulnerability in the affected devices could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial of service attack. Siemens has released updates for several affected products and recommends to update to the new versions. Siemens is preparing further updates and ...

SSA-592007 V1.7 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in Industrial Products

Title

SSA-592007 V1.7 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in Industrial Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-592007.pdf

Summary

Several industrial controllers are affected by a security vulnerability that could allow an attacker to cause a Denial-of-Service condition via PROFINET DCP network packets under certain circumstances. Precondition for this scenario is a direct OSI Layer 2 access to the affected products. PROFIBUS interfaces are not affected. Siemens has released ...

SSA-780073 V2.2 (Last Update: 2022-06-14): Denial of Service Vulnerability in PROFINET Devices via DCE-RPC Packets

Title

SSA-780073 V2.2 (Last Update: 2022-06-14): Denial of Service Vulnerability in PROFINET Devices via DCE-RPC Packets

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-780073.pdf

Summary

Products that include the Siemens PROFINET-IO (PNIO) stack in versions prior V06.00 are potentially affected by a denial of service vulnerability when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. Siemens has released updates for several affected products and recommends to update to the new versions. Siemens ...

SSA-626968 V1.1 (Last Update: 2022-06-14): Multiple Webserver Vulnerabilities in Desigo PXC and DXR Devices

Title

SSA-626968 V1.1 (Last Update: 2022-06-14): Multiple Webserver Vulnerabilities in Desigo PXC and DXR Devices

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf

Summary

Desigo PXC3, PXC4, PXC5 and DXR2 devices contain multiple vulnerabilities in the webserver application that could allow an attacker to potentially intercept unencrypted transmission of sensitive information, cause a denial of service condition, or perform remote code execution. Siemens has released updates for the affected products and recommends to update ...

SSA-593272 V1.7 (Last Update: 2022-06-14): SegmentSmack in Interniche IP-Stack based Industrial Devices

Title

SSA-593272 V1.7 (Last Update: 2022-06-14): SegmentSmack in Interniche IP-Stack based Industrial Devices

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-593272.pdf

Summary

A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released updates for several ...

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Title

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf

Summary

Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or PAR) with any of the affected products, this could lead the application to crash or potentially lead to ...

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Title

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-220589.pdf

Summary

Siemens has released updates for Teamcenter that fixes a security vulnerability related to unsecure storage of user credentials. This vulnerability affects Java EE Server Manager HTML Adaptor. This service is not installed by default and currently also obsoleted. Siemens has released updates for the affected products and recommends to update ...

SSA-693555 V1.0: Memory Corruption Vulnerability in EN100 Ethernet Module

Title

SSA-693555 V1.0: Memory Corruption Vulnerability in EN100 Ethernet Module

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf

Summary

EN100 Ethernet module is affected by memory corruption vulnerability (CVE-2022-30937). Siemens has released an update for the EN100 Ethernet module IEC 61850 variant and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

SSA-145224 V1.0: Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices

Title

SSA-145224 V1.0: Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-145224.pdf

Summary

SCALANCE XM-400 and XR-500 devices contain a vulnerability in the OSPF protocol implementation that could allow an unauthenticated remote attacker to cause interruptions in the network. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-222547 V1.0: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0

Title

SSA-222547 V1.0: Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf

Summary

Multiple vulnerabilities in the third-party components CivetWeb, Docker, Linux Kernel and systemd could allow an attacker to impact SCALANCE LPE9403 confidentiality, integrity and availability. Siemens has released an update for the SCALANCE LPE9403 and recommends to update to the latest version.

SSA-732250 V1.1 (Last Update: 2022-06-14): Libcurl Vulnerabilities in Industrial Devices

Title

SSA-732250 V1.1 (Last Update: 2022-06-14): Libcurl Vulnerabilities in Industrial Devices

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf

Summary

Vulnerabilities in third-party component cURL could allow an attacker to interfere with the affected products in various ways. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not ...

SSA-549234 V1.2 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in SIMATIC NET CP Modules

Title

SSA-549234 V1.2 (Last Update: 2022-06-14): Denial-of-Service Vulnerability in SIMATIC NET CP Modules

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-549234.pdf

Summary

A denial of service vulnerability was identified in different types of Communication Processors. An attacker could exploit this vulnerability causing the device to become un-operational until the device is restarted. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Title

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf

Summary

The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit’s pkexec utility, that could allow an unprivileged user to gain administrative rights. Siemens has released updates for the affected products and recommends to update to the latest versions.