June 2022
14.06.2022
SIEMENS CERT
SSA-911567 V1.0: Missing HTTP headers in SINEMA Remote Connect Server before V3.0 SP2
Title
SSA-911567 V1.0: Missing HTTP headers in SINEMA Remote Connect Server before V3.0 SP2
Published
June 14, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf
Summary
SINEMA Remote Connect Server is missing HTTP security headers on the web server. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors. Siemens has released an update for the SINEMA Remote Connect Server and recommends to update to ...
14.06.2022
SIEMENS CERT
SSA-941426 V1.2 (Last Update: 2022-06-14): Multiple LLDP Vulnerabilities in Industrial Products
Title
SSA-941426 V1.2 (Last Update: 2022-06-14): Multiple LLDP Vulnerabilities in Industrial Products
Published
June 14, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
Summary
There are multiple vulnerabilities in an underlying Link Layer Discovery Protocol (LLDP) third party library. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
14.06.2022
SIEMENS CERT
SSA-978220 V1.7 (Last Update: 2022-06-14): Denial of Service Vulnerability over SNMP in Multiple Industrial Products
Title
SSA-978220 V1.7 (Last Update: 2022-06-14): Denial of Service Vulnerability over SNMP in Multiple Industrial Products
Published
June 14, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-978220.pdf
Summary
Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a denial of service attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released updates for several affected products and recommends to update to the new versions. Siemens is preparing further updates ...
14.06.2022
SIEMENS CERT
SSA-693555 V1.0: Memory Corruption Vulnerability in EN100 Ethernet Module
Title
SSA-693555 V1.0: Memory Corruption Vulnerability in EN100 Ethernet Module
Published
June 14, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf
Summary
EN100 Ethernet module is affected by memory corruption vulnerability (CVE-2022-30937). Siemens has released an update for the EN100 Ethernet module IEC 61850 variant and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
14.06.2022
SIEMENS CERT
SSA-988345 V1.0: Local Privilege Escalation Vulnerability in Xpedition Designer
Title
SSA-988345 V1.0: Local Privilege Escalation Vulnerability in Xpedition Designer
Published
June 14, 2022, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdf
Summary
A vulnerability in Xpedition Designer could allow an attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges. Siemens has released an update for the Xpedition Designer and recommends to update to the latest version.
08.06.2022
US CERT
AA22-158A: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices
Title
AA22-158A: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices
Published
June 8, 2022, midnight
URL
https://us-cert.cisa.gov/ncas/alerts/aa22-158a
Summary
Original release date: June 7, 2022SummaryBest Practices • Apply patches as soon as possible • Disable unnecessary ports and protocols • Replace end-of-life infrastructure • Implement a centralized patch management system This joint Cybersecurity Advisory describes the ways in which People’s Republic of China (PRC) state-sponsored cyber actors continue to ...
07.06.2022
US CERT (ICS)
Mitsubishi Electric MELSEC and MELIPC Series (Update C)
Title
Mitsubishi Electric MELSEC and MELIPC Series (Update C)
Published
June 7, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02
Summary
This updated advisory is a follow up to the advisory update titled ICSA-21-334-02 Mitsubishi Electric MELSEC and MELIPC Series (Update B) that was published April 26, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Uncontrolled Resource Consumption, Improper Handling of Length Parameter Inconsistency, and Improper Input ...
03.06.2022
US CERT (ICS)
Vulnerabilities Affecting Dominion Voting Systems ImageCast X
Title
Vulnerabilities Affecting Dominion Voting Systems ImageCast X
Published
June 3, 2022, 9 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-154-01
Summary
This advisory contains mitigations for Improper Verification of Cryptographic Signature, Mutable Attestation of Measurement Reporting Data, Hidden Functionality, Improper Protection of Alternate Path, Path Traversal: ''../filedir', Execution with Unnecessary Privileges, Authentication Bypass Spoofing, Incorrect Privilege Assignment, and Origin Validation Error vulnerabilities in versions of Dominion Voting Systems Democracy Suite ImageCast ...
02.06.2022
US CERT (ICS)
Carrier LenelS2 HID Mercury access panels
Title
Carrier LenelS2 HID Mercury access panels
Published
June 2, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-153-01
Summary
This advisory contains mitigations for Protection Mechanism Failure, Forced Browsing, Classic Buffer Overflow, Path Traversal, and OS Command Injection vulnerabilities in Carrier HID Mercury access panels sold by LenlS2.
02.06.2022
US CERT (ICS)
Illumina Local Run Manager
Title
Illumina Local Run Manager
Published
June 2, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-153-02
Summary
This advisory contains mitigations for Path Traversal, Unrestricted Upload of File with Dangerous Type, Improper Access Control, and Cleartext Transmission of Sensitive Information vulnerabilities in Illumina devices using Local Run Manager software.
01.06.2022
US CERT
AA22-152A: Karakurt Data Extortion Group
Title
AA22-152A: Karakurt Data Extortion Group
Published
June 1, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ncas/alerts/aa22-152a
Summary
Original release date: June 1, 2022SummaryActions to take today to mitigate cyber threats from ransomware: • Prioritize patching known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enforce multifactor authentication. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of ...
May 2022
31.05.2022
US CERT (ICS)
BD Synapsys
Title
BD Synapsys
Published
May 31, 2022, 4:25 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsma-22-151-02
Summary
This advisory contains mitigations for an Insufficient Session Expiration vulnerability in the BD Synapsys microbiology informatics software platform.
31.05.2022
US CERT (ICS)
Mitsubishi Electric MELSEC iQ-F Series (Update A)
Title
Mitsubishi Electric MELSEC iQ-F Series (Update A)
Published
May 31, 2022, 4:15 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-139-01
Summary
This updated advisory is a follow-up to the original advisory titled ICSA-22-139-01 Mitsubishi Electric MELSEC iQ-F Series that was published May 19, 2022, on the ICS webpage at cisa.gov/ics. This advisory contains mitigations for Improper Input Validation vulnerabilities in Mitsubishi Electric MELSEC iQ-F Series CPU modules.
31.05.2022
US CERT (ICS)
Mitsubishi Electric FA Products (Update A)
Title
Mitsubishi Electric FA Products (Update A)
Published
May 31, 2022, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-090-04
Summary
This updated advisory is a follow-up to the original advisory titled ICSA-22-090-04 Mitsubishi Electric FA Products that was published March 31, 2022, on the ICS webpage on cisa.gov/ics. This advisory contains mitigations for a Use of Password Hash Instead of Password for Authentication, Use of Weak Hash, Cleartext Storage of ...
31.05.2022
US CERT (ICS)
Mitsubishi Electric Multiple Products (Update D)
Title
Mitsubishi Electric Multiple Products (Update D)
Published
May 31, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-20-245-01
Summary
This updated advisory is a follow-up to the advisory update titled ICSA-20-245-01 Mitsubishi Electric Multiple Products (Update C) that was published September 9, 2021, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for a Predictable Exact Value from Previous Values vulnerability in several Mitsubishi Electric devices.
31.05.2022
US CERT (ICS)
Mitsubishi Electric Factory Automation Engineering Software (Update B)
Title
Mitsubishi Electric Factory Automation Engineering Software (Update B)
Published
May 31, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-20-212-02
Summary
This updated advisory is a follow-up to the advisory update titled ICSA-20-212-02 Mitsubishi Electric Factory Automation Engineering Software (Update A) that was published January 5, 2021, to the ICS webpage on ucisa.gov/ics. This advisory contains mitigations for a Permission Issues vulnerability in Mitsubishi Electric Factory Automation Engineering software products.
26.05.2022
US CERT (ICS)
Keysight N6854A Geolocation server and N6841A RF Sensor software
Title
Keysight N6854A Geolocation server and N6841A RF Sensor software
Published
May 26, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-146-01
Summary
This advisory contains mitigations for Relative Path Traversal, and Deserialization of Untrusted Data vulnerabilities in Keysight N6854A Geolocation and server and N6841A Sensor software, a spectrum monitoring platform.
26.05.2022
US CERT (ICS)
Horner Automation Cscape Csfont
Title
Horner Automation Cscape Csfont
Published
May 26, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-146-02
Summary
This advisory contains mitigations for Out-of-bounds Write, Out-of-bounds Read, and Heap-based Buffer Overflow vulnerabilities in Horner Automation Cscape PLC management software.
24.05.2022
US CERT (ICS)
Matrikon OPC Server
Title
Matrikon OPC Server
Published
May 24, 2022, 4:10 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-144-02
Summary
This advisory contains mitigations for an Improper Access Control vulnerability in Makitron OPC software.
24.05.2022
US CERT (ICS)
Mitsubishi Electric FA Engineering Software Products (Update E)
Title
Mitsubishi Electric FA Engineering Software Products (Update E)
Published
May 24, 2022, 4:05 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-21-049-02
Summary
This updated advisory is a follow-up to the advisory update titled ICSA-21-049-02 Mitsubishi Electric FA Engineering Software Products (Update D) that was published February 8, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Heap-based Buffer Overflow, and Improper Handling of Length Parameter Inconsistency vulnerabilities in Mitsubishi ...
24.05.2022
US CERT (ICS)
Mitsubishi Electric Factory Automation Engineering Products (Update G)
Title
Mitsubishi Electric Factory Automation Engineering Products (Update G)
Published
May 24, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-20-212-04
Summary
This updated advisory is a follow-up to the advisory update titled ICSA-20-212-04 Mitsubishi Electric Factory Automation Engineering Products (Update F) that was published February 8, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for an Unquoted Search Path or Element vulnerability in Mitsubishi Electric Factory Automation Engineering ...
19.05.2022
US CERT (ICS)
Mitsubishi Electric MELSEC iQ-F Series
Title
Mitsubishi Electric MELSEC iQ-F Series
Published
May 19, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-139-01
Summary
This advisory contains mitigations for Improper Input Validation vulnerabilities in Mitsubishi Electric MELSEC iQ-F Series CPU modules.
18.05.2022
US CERT
AA22-138B: Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control
Title
AA22-138B: Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control
Published
May 18, 2022, 8 p.m.
URL
https://us-cert.cisa.gov/ncas/alerts/aa22-138b
Summary
Original release date: May 18, 2022SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory (CSA) to warn organizations that malicious cyber actors, likely advanced persistent threat (APT) actors, are exploiting CVE-2022-22954 and CVE-2022-22960 separately and in combination. These vulnerabilities affect certain versions of VMware Workspace ONE Access, ...
18.05.2022
US CERT
AA22-138A: Threat Actors Exploiting F5 BIG-IP CVE-2022-1388
Title
AA22-138A: Threat Actors Exploiting F5 BIG-IP CVE-2022-1388
Published
May 18, 2022, 3 p.m.
URL
https://us-cert.cisa.gov/ncas/alerts/aa22-138a
Summary
Original release date: May 18, 2022SummaryActions for administrators to take today: • Do not expose management interfaces to the internet. • Enforce multi-factor authentication. • Consider using CISA’s Cyber Hygiene Services. The Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) are releasing this ...
17.05.2022
US CERT (ICS)
Circutor COMPACT DC-S BASIC
Title
Circutor COMPACT DC-S BASIC
Published
May 17, 2022, 4 p.m.
URL
https://us-cert.cisa.gov/ics/advisories/icsa-22-137-01
Summary
This advisory contains mitigations for a Stack-based Buffer Overflow vulnerability in the Circutor COMPACT DC-S BASIC smart metering concentrator.

Last Updates

BOSCH PSIRT
15.01.2025
SIEMENS CERT
17.04.2025
US CERT
01.04.2025
US CERT (ICS)
17.04.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds