Bulletins | CERT@VDE

SSA-640732 V1.0: Authentication Bypass Vulnerability in Siveillance Video Mobile Server

Title

SSA-640732 V1.0: Authentication Bypass Vulnerability in Siveillance Video Mobile Server

Published

Oct. 21, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-640732.pdf

Summary

The mobile server component of Siveillance Video 2022 R2 contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to access the application without a valid account. Siemens has released a hotfix for Siveillance Video 2022 R2 and recommends to apply the hotfix on all installations of the ...

20.10.2022

Bentley Systems MicroStation Connect

Title

Bentley Systems MicroStation Connect

Published

Oct. 20, 2022, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-293-01

Summary

20.10.2022

B. Braun Infusomat Space Large Volume Pump (Update A)

Title

B. Braun Infusomat Space Large Volume Pump (Update A)

Published

Oct. 20, 2022, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-294-01

Summary

This advisory contains mitigation for Unrestricted Upload of File with Dangerous Type, Cleartext Transmission of Sensitive Information, Missing Authentication for Critical Function, Insufficient Verification of Data Authenticity, and Improper Input Validation vulnerabilities in the B. Braun Infusomat Space Large Volume Pump.

19.10.2022

BOSCH PSIRT

Multiple Cross Site Scripting vulnerabilities in Bosch VIDEOJET multi 4000

Title

Multiple Cross Site Scripting vulnerabilities in Bosch VIDEOJET multi 4000

Published

Oct. 19, 2022, 2 a.m.

URL

https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html

Summary

BOSCH-SA-454166-BT: The possibility for a reflected Cross Site Scripting (XSS) and stored Cross Site Scripting (XSS) attack was discovered in the Bosch VIDEOJET multi 4000.For more details please see the description of the vulnerability in this advisory.Bosch rates this vulnerability with CVSSv3.1 base score 5.8 (medium) and 5.1 (medium), where ...

19.10.2022

BOSCH PSIRT

CVE-2021-3772 Linux Kernel Vulnerability in NetApp DSA E2800 series

Title

CVE-2021-3772 Linux Kernel Vulnerability in NetApp DSA E2800 series

Published

Oct. 19, 2022, 2 a.m.

URL

https://psirt.bosch.com/security-advisories/bosch-sa-609377-bt.html

Summary

BOSCH-SA-609377-BT: The Bosch DSA E2800 products are based on NetApp technology, which incorporate a Linux Kernel. Linux Kernel versions prior to 5.15.0 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or Denial of Service (DoS). Successful exploitation of this vulnerability could ...

Siemens Industrial Edge Management

Title

Siemens Industrial Edge Management

Published

Oct. 13, 2022, 4:46 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-02

Summary

Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service

Title

Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service

Published

Oct. 13, 2022, 4:40 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-05

Summary

This advisory contains mitigations for Allocation of Resources Without Limits or Throttling and Code Injection vulnerabilities in versions of Hitachi Energy Lumada Asset Performance Manager (APM) software.

Siemens Desigo PXM Devices

Title

Siemens Desigo PXM Devices

Published

Oct. 13, 2022, 4:38 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-06

Summary

Siemens Nucleus RTOS FTP Server

Title

Siemens Nucleus RTOS FTP Server

Published

Oct. 13, 2022, 4:36 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-07

Summary

Siemens TCP Event Service of SCALANCE And RUGGEDCOM Devices

Title

Siemens TCP Event Service of SCALANCE And RUGGEDCOM Devices

Published

Oct. 13, 2022, 4:34 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-08

Summary

Siemens SICAM P850 and P855 Devices

Title

Siemens SICAM P850 and P855 Devices

Published

Oct. 13, 2022, 4:32 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-286-09

Summary

Altair HyperView Player

Title

Altair HyperView Player

Published

Oct. 11, 2022, 4:20 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-284-01

Summary

Daikin Holdings Singapore Pte Ltd. SVMPC1 and SVMPC2

Title

Daikin Holdings Singapore Pte Ltd. SVMPC1 and SVMPC2

Published

Oct. 11, 2022, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-284-02

Summary

SSB-898115 V1.0: Remarks Regarding SSA-568427 (Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families)

Title

SSB-898115 V1.0: Remarks Regarding SSA-568427 (Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families)

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssb-898115.pdf

Summary

SSA-836027 V1.0: Client-side Authentication in Desigo CC and Cerberus DMS

Title

SSA-836027 V1.0: Client-side Authentication in Desigo CC and Cerberus DMS

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-836027.pdf

Summary

Desigo CC and Cerberus DMS are based on SIMATIC WinCC OA and implement client-side only authentication for specific parts of their client-server communication. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated, as documented for SIMATIC WinCC OA in SSA-111512 [1]. Siemens recommends ...

SSA-917476 V1.1 (Last Update: 2022-10-11): Multiple Vulnerabilities in SCALANCE W1750D

Title

SSA-917476 V1.1 (Last Update: 2022-10-11): Multiple Vulnerabilities in SCALANCE W1750D

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf

Summary

The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to execute code on the affected device(s), read arbitrary files, or create a denial-of-service condition. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-712929 V1.4 (Last Update: 2022-10-11): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Prod...

Title

SSA-712929 V1.4 (Last Update: 2022-10-11): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf

Summary

A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL. Siemens has released updates for several affected products and recommends to update to the latest ...

SSA-552702 V1.0: Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Products

Title

SSA-552702 V1.0: Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Products

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-552702.pdf

Summary

The products listed below do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific ...

SSA-572005 V1.0: Vulnerabilities in the Web Server of SICAM P850 and SICAM P855 Devices

Title

SSA-572005 V1.0: Vulnerabilities in the Web Server of SICAM P850 and SICAM P855 Devices

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf

Summary

Session fixation and incorrect parameter parsing vulnerabilities were identified in the web server of SICAM P850 and SICAM P855 devices. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-568427 V1.0: Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families

Title

SSA-568427 V1.0: Weak Key Protection Vulnerability in SIMATIC S7-1200 and S7-1500 CPU Families

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-568427.pdf

Summary

SIMATIC S7-1200, S7-1500 CPUs and related products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private ...

SSA-649853 V1.0: Improper Certificate Validation Vulnerability in Industrial Edge Management

Title

SSA-649853 V1.0: Improper Certificate Validation Vulnerability in Industrial Edge Management

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-649853.pdf

Summary

Industrial Edge Management contains a vulnerability that could allow an unauthenticated attacker to spoof a trusted entity by interfering in the communication path between the Industrial Edge Management (IEM) and the Industrial Edge Hub (IEH) using a crafted certificate. An attacker could use this to inject malicious maintenance requests (e.g. ...

SSA-384224 V1.0: Denial of Service Vulnerability in SIMATIC HMI Panels

Title

SSA-384224 V1.0: Denial of Service Vulnerability in SIMATIC HMI Panels

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-384224.pdf

Summary

Several SIMATIC HMI Panels are affected by a vulnerability that could allow an attacker to cause a permanent denial of service condition (requiring a device reboot) by sending specially crafted TCP packets. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-501891 V1.0: Cross-Site Scripting Vulnerability in SCALANCE X-200 and X-200IRT Families

Title

SSA-501891 V1.0: Cross-Site Scripting Vulnerability in SCALANCE X-200 and X-200IRT Families

Published

Oct. 11, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-501891.pdf

Summary

There is a cross-site scripting vulnerability that affects the SCALANCE switches. This vulnerability if used by a threat actor could result in the stealing of session cookies and session hijacking. Siemens has released updates for the affected products and recommends to update to the latest versions.