• 1 (current)
  • 2
  • 3
Thursday, 19.09.2024
17:28
US CERT
CISA Adds One Known Exploited Vulnerability to Catalog
Title
CISA Adds One Known Exploited Vulnerability to Catalog
Published
Sept. 19, 2024, 5:28 p.m.
URL
https://www.cisa.gov/news-events/alerts/2024/09/19/cisa-adds-one-known-exploited-vulnerability-catalog
Summary
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive ...
14:00
US CERT (ICS)
IDEC CORPORATION WindLDR and WindO/I-NV4
Title
IDEC CORPORATION WindLDR and WindO/I-NV4
Published
Sept. 19, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: IDEC Corporation Equipment: WindLDR, WindO/I-NV4 Vulnerability: Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of WindLDR ...
14:00
US CERT (ICS)
Kastle Systems Access Control System
Title
Kastle Systems Access Control System
Published
Sept. 19, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Kastle Systems Equipment: Access Control System Vulnerabilities: Use of Hard-coded Credentials, Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information on the affected product. ...
14:00
US CERT (ICS)
MegaSys Computer Technologies Telenium Online Web Application
Title
MegaSys Computer Technologies Telenium Online Web Application
Published
Sept. 19, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: MegaSys Computer Technologies Equipment: Telenium Online Web Application Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to inject arbitrary Perl code through a crafted HTTP request, leading to ...
14:00
US CERT (ICS)
Rockwell Automation RSLogix 5 and RSLogix 500
Title
Rockwell Automation RSLogix 5 and RSLogix 500
Published
Sept. 19, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.8 ATTENTION: Exploitable locally/high attack complexity Vendor: Rockwell Automation Equipment: RSLogix 5 and RSLogix 500 Vulnerability: Insufficient verification of data authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
Tuesday, 17.09.2024
14:00
US CERT (ICS)
Yokogawa Dual-redundant Platform for Computer (PC2CKM)
Title
Yokogawa Dual-redundant Platform for Computer (PC2CKM)
Published
Sept. 17, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Yokogawa Equipment: Dual-redundant Platform for Computer (PC2CKM) Vulnerability: Unchecked Return Value 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a denial-of-service. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions ...
14:00
US CERT (ICS)
Millbeck Communications Proroute H685t-w
Title
Millbeck Communications Proroute H685t-w
Published
Sept. 17, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Millbeck Communications Equipment: Proroute H685t-w Vulnerabilities: Command Injection, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary commands on the device's operating system. 3. TECHNICAL DETAILS 3.1 AFFECTED ...
Thursday, 12.09.2024
14:00
US CERT (ICS)
Rockwell Automation FactoryTalk Batch View
Title
Rockwell Automation FactoryTalk Batch View
Published
Sept. 12, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-22
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: FactoryTalk Batch View Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker bypassing authentication. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell Automation FactoryTalk Batch ...
14:00
US CERT (ICS)
Siemens SIMATIC SCADA and PCS 7 Systems
Title
Siemens SIMATIC SCADA and PCS 7 Systems
Published
Sept. 12, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-14
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14:00
US CERT (ICS)
AutomationDirect DirectLogic H2-DM1E
Title
AutomationDirect DirectLogic H2-DM1E
Published
Sept. 12, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-17
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable from an adjacent network/low attack complexity Vendor: AutomationDirect Equipment: DirectLogic H2-DM1E Vulnerabilities: Session Fixation, Authentication Bypass by Capture-replay 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to inject traffic into an ongoing authenticated session or authenticate ...
14:00
US CERT (ICS)
Rockwell Automation FactoryTalk View Site
Title
Rockwell Automation FactoryTalk View Site
Published
Sept. 12, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-23
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform unauthenticated remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell ...
14:00
US CERT (ICS)
Rockwell Automation AADvance Trusted SIS Workstation
Title
Rockwell Automation AADvance Trusted SIS Workstation
Published
Sept. 12, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-20
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: AADvance Trusted SIS Workstation Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an attacker executing code within the context of a current process. 3. TECHNICAL DETAILS 3.1 ...
14:00
US CERT (ICS)
Siemens SINUMERIK ONE, SINUMERIK 840D and SINUMERIK 828D
Title
Siemens SINUMERIK ONE, SINUMERIK 840D and SINUMERIK 828D
Published
Sept. 12, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-02
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
02:00
SIEMENS CERT
SSA-097435 V1.1 (Last Update: 2024-09-12): Usernames Disclosure Vulnerability in Mendix Runtime
Title
SSA-097435 V1.1 (Last Update: 2024-09-12): Usernames Disclosure Vulnerability in Mendix Runtime
Published
Sept. 12, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-097435.html
Summary
Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Tuesday, 10.09.2024
14:00
US CERT (ICS)
Viessmann Climate Solutions SE Vitogate 300
Title
Viessmann Climate Solutions SE Vitogate 300
Published
Sept. 10, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Viessmann Climate Solutions SE Equipment: Vitogate 300 Vulnerabilities: Use of Hard-coded Credentials, Forced Browsing, Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to achieve remote code execution. ...
14:00
US CERT (ICS)
iniNet Solutions SpiderControl SCADA Web Server
Title
iniNet Solutions SpiderControl SCADA Web Server
Published
Sept. 10, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: iniNet Solutions GmbH Equipment: SpiderControl SCADA Web Server Vulnerabilities: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to log in or execute arbitrary code. 3. ...
14:00
US CERT (ICS)
Rockwell Automation SequenceManager
Title
Rockwell Automation SequenceManager
Published
Sept. 10, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-254-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: SequenceManager Vulnerabilities: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of SequenceManager, a logix ...
02:00
SIEMENS CERT
SSA-792319 V1.1 (Last Update: 2024-09-10): Missing Read Out Protection in SENTRON 7KM PAC3x20 Devices
Title
SSA-792319 V1.1 (Last Update: 2024-09-10): Missing Read Out Protection in SENTRON 7KM PAC3x20 Devices
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-792319.html
Summary
The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data. Siemens has released new versions for the affected products and recommends to update to the ...
02:00
SIEMENS CERT
SSA-832273 V1.5 (Last Update: 2024-09-10): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices
Title
SSA-832273 V1.5 (Last Update: 2024-09-10): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-832273.html
Summary
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.
02:00
SIEMENS CERT
SSA-999588 V1.5 (Last Update: 2024-09-10): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Title
SSA-999588 V1.5 (Last Update: 2024-09-10): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-999588.html
Summary
Siemens User Management Component (UMC) before V2.11.2 is affected by multiple vulnerabilities where the most severe could lead to a restart of the UMC server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes ...
02:00
SIEMENS CERT
SSA-844582 V1.1 (Last Update: 2024-09-10): Electromagnetic Fault Injection in LOGO! V8.3 BM Devices Results in Broken LOGO! V8....
Title
SSA-844582 V1.1 (Last Update: 2024-09-10): Electromagnetic Fault Injection in LOGO! V8.3 BM Devices Results in Broken LOGO! V8.3 Product CA
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-844582.html
Summary
LOGO! V8.3 BM (incl. SIPLUS variants) devices contain a vulnerability that could allow an electromagnetic fault injection. This could allow an attacker to dump and debug the firmware, including the manipulation of memory. Further actions could allow to inject public keys of custom created key pairs which are then signed ...
02:00
SIEMENS CERT
SSA-673996 V1.0: Buffer Overflow Vulnerability in Third-Party Component in SICAM and SITIPE Products
Title
SSA-673996 V1.0: Buffer Overflow Vulnerability in Third-Party Component in SICAM and SITIPE Products
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-673996.html
Summary
Multiple SICAM products are affected by buffer overflow vulnerability in the IEC 61850 Client libraries from Triangle MicroWorks that could allow an unauthenticated remote attacker to create a denial of service condition by sending specially crafted MMS messages. Affected SICAM and SITIPE products: SICAM A8000 Device firmware ETI5 for CP-8031/CP-8050 ...
02:00
SIEMENS CERT
SSA-690517 V1.1 (Last Update: 2024-09-10): Multiple Vulnerabilities in SCALANCE W700 802.11 AX Family
Title
SSA-690517 V1.1 (Last Update: 2024-09-10): Multiple Vulnerabilities in SCALANCE W700 802.11 AX Family
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-690517.html
Summary
SCALANCE W700 802.11 AX Family is affected by multiple vulnerabilities. Siemens recommends countermeasures for products where fixes are not, or not yet available.
02:00
SIEMENS CERT
SSA-869574 V1.0: Multiple Vulnerabilities in SINEMA Remote Connect Server Before V3.2 SP2
Title
SSA-869574 V1.0: Multiple Vulnerabilities in SINEMA Remote Connect Server Before V3.2 SP2
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-869574.html
Summary
SINEMA Remote Connect Server before V3.2 SP2 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.
02:00
SIEMENS CERT
SSA-962515 V1.2 (Last Update: 2024-09-10): Out of Bounds Read Vulnerability in Industrial Products
Title
SSA-962515 V1.2 (Last Update: 2024-09-10): Out of Bounds Read Vulnerability in Industrial Products
Published
Sept. 10, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-962515.html
Summary
Several industrial products contain an out of bounds read vulnerability that could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel, leading to denial of service condition. Siemens has released new versions for several affected products and recommends to update to the ...
  • 1 (current)
  • 2
  • 3

Last Updates

BOSCH PSIRT
21.08.2024
SIEMENS CERT
12.09.2024
US CERT
19.09.2024
US CERT (ICS)
19.09.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds