Bulletins | CERT@VDE

SSA-414513 V1.1 (Last Update: 2022-06-14): Information Disclosure Vulnerability in Mendix

Title

SSA-414513 V1.1 (Last Update: 2022-06-14): Information Disclosure Vulnerability in Mendix

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-414513.pdf

Summary

An information disclosure vulnerability in Mendix applications was discovered. The vulnerability could allow to read sensitive data. Siemens has released updates for several Mendix Applications and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet ...

SSA-401167 V1.0: Cross-site scripting Vulnerability in Teamcenter Active Workspace

Title

SSA-401167 V1.0: Cross-site scripting Vulnerability in Teamcenter Active Workspace

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-401167.pdf

Summary

Teamcenter Active Workspace is affected by a cross site scripting vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-388239 V1.0: Default Password Leakage affecting the Component Shared HIS used in Spectrum Power Systems

Title

SSA-388239 V1.0: Default Password Leakage affecting the Component Shared HIS used in Spectrum Power Systems

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf

Summary

Siemens has been made aware of a default password leakage in the internet affecting the component Shared HIS (SHHIS) used in Spectrum Power systems. The products listed below are affected by this default password leakage. This could allow an attacker to access the component Shared HIS of those products with ...

SSA-363107 V1.1 (Last Update: 2022-06-14): An Improper Initialization Vulnerability Affects SIMATIC WinCC Kiosk Mode

Title

SSA-363107 V1.1 (Last Update: 2022-06-14): An Improper Initialization Vulnerability Affects SIMATIC WinCC Kiosk Mode

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-363107.pdf

Summary

A vulnerability was found in SIMATIC WinCC that could allow authenticated attackers to escape the Kiosk Mode. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Title

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf

Summary

The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit’s pkexec utility, that could allow an unprivileged user to gain administrative rights. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-324955 V1.8 (Last Update: 2022-06-14): SAD DNS Attack in Linux Based Products

Title

SSA-324955 V1.8 (Last Update: 2022-06-14): SAD DNS Attack in Linux Based Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-324955.pdf

Summary

A vulnerability made public under the name SAD DNS affects Domain Name System resolvers due to a vulnerability in the Linux kernel when handling ICMP packets. The Siemens products which are affected are listed below. For more information please see https://www.saddns.net/. Siemens has released updates for several affected products and ...

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Title

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf

Summary

Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or PAR) with any of the affected products, this could lead the application to crash or potentially lead to ...

SSA-254054 V1.2 (Last Update: 2022-06-14): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impac...

Title

SSA-254054 V1.2 (Last Update: 2022-06-14): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf

Summary

A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as “Spring4Shell” or “SpringShell”. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as ...

SSA-244969 V1.5 (Last Update: 2022-06-14): OpenSSL Vulnerability in Industrial Products

Title

SSA-244969 V1.5 (Last Update: 2022-06-14): OpenSSL Vulnerability in Industrial Products

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf

Summary

OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for several affected products and recommends to update to ...

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Title

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Published

June 14, 2022, 2 a.m.

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-220589.pdf

Summary

Siemens has released updates for Teamcenter that fixes a security vulnerability related to unsecure storage of user credentials. This vulnerability affects Java EE Server Manager HTML Adaptor. This service is not installed by default and currently also obsoleted. Siemens has released updates for the affected products and recommends to update ...

Wednesday, 08.06.2022

00:00

US CERT

AA22-158A: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

Title

AA22-158A: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

Published

June 8, 2022, midnight

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-158a

Summary

Original release date: June 7, 2022SummaryBest Practices • Apply patches as soon as possible • Disable unnecessary ports and protocols • Replace end-of-life infrastructure • Implement a centralized patch management system This joint Cybersecurity Advisory describes the ways in which People’s Republic of China (PRC) state-sponsored cyber actors continue to ...

Tuesday, 07.06.2022

16:00

Mitsubishi Electric MELSEC and MELIPC Series (Update C)

Title

Mitsubishi Electric MELSEC and MELIPC Series (Update C)

Published

June 7, 2022, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02

Summary

This updated advisory is a follow up to the advisory update titled ICSA-21-334-02 Mitsubishi Electric MELSEC and MELIPC Series (Update B) that was published April 26, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Uncontrolled Resource Consumption, Improper Handling of Length Parameter Inconsistency, and Improper Input ...

Friday, 03.06.2022

21:00

Vulnerabilities Affecting Dominion Voting Systems ImageCast X

Title

Vulnerabilities Affecting Dominion Voting Systems ImageCast X

Published

June 3, 2022, 9 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-154-01

Summary

This advisory contains mitigations for Improper Verification of Cryptographic Signature, Mutable Attestation of Measurement Reporting Data, Hidden Functionality, Improper Protection of Alternate Path, Path Traversal: ''../filedir', Execution with Unnecessary Privileges, Authentication Bypass Spoofing, Incorrect Privilege Assignment, and Origin Validation Error vulnerabilities in versions of Dominion Voting Systems Democracy Suite ImageCast ...

Thursday, 02.06.2022

16:05

Carrier LenelS2 HID Mercury access panels

Title

Carrier LenelS2 HID Mercury access panels

Published

June 2, 2022, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-153-01

Summary

This advisory contains mitigations for Protection Mechanism Failure, Forced Browsing, Classic Buffer Overflow, Path Traversal, and OS Command Injection vulnerabilities in Carrier HID Mercury access panels sold by LenlS2.

16:00