Bulletins | CERT@VDE

Siemens SIMATIC IPC Family, ITP1000, and Field PGs

Title

Siemens SIMATIC IPC Family, ITP1000, and Field PGs

Published

March 13, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-11

Summary

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY CVSS ...

Siemens SIMATIC S7-1500 TM MFP

Title

Siemens SIMATIC S7-1500 TM MFP

Published

March 13, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-03

Summary

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-09

Siemens OPC UA

Title

Siemens OPC UA

Published

March 13, 2025, 1 p.m.

URL

Summary

Sungrow iSolarCloud Android App WiNet Firmware

Title

Sungrow iSolarCloud Android App WiNet Firmware

Published

March 13, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-12

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.5 ATTENTION: Exploitable remotely Vendor: Sungrow Equipment: iSolarCloud Android App, WiNet Firmware Vulnerabilities: Improper Certificate Validation, Use of a Broken or Risky Cryptographic Algorithm, Authorization Bypass Through User-Controlled Key, User of Hard-Coded Credentials, Stack-Based Buffer Overflow, Heap-Based Buffer Overflow 2. RISK EVALUATION Successful ...

Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation

Title

Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation

Published

March 13, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-01

Summary

Siemens SINAMICS S200

Title

Siemens SINAMICS S200

Published

March 13, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-05

Summary

Siemens SCALANCE M-800 and SC-600 Families

Title

Siemens SCALANCE M-800 and SC-600 Families

Published

March 13, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-07

Summary

Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP

Title

Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP

Published

March 13, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-04

Summary

11.03.2025

Schneider Electric Uni-Telway Driver

Title

Schneider Electric Uni-Telway Driver

Published

March 11, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Uni-Telway Driver Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a denial of service. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Schneider Electric reports the ...

11.03.2025

Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool

Title

Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool

Published

March 11, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Optigo Networks Equipment: Visual BACnet Capture Tool, Optigo Visual Networks Capture Tool Vulnerabilities: Use of Hard-coded, Security-relevant Constants, Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-04

Hitachi Energy XMC20

Title

Hitachi Energy XMC20

Published

March 4, 2025, 1 p.m.

URL

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: XMC20 Vulnerability: Relative Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access files or directories outside the authorized scope. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi ...

Keysight Ixia Vision Product Family

Title

Keysight Ixia Vision Product Family

Published

March 4, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Keysight Equipment: Ixia Vision Product Family Vulnerabilities: Path Traversal, Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device being accessed; a buffer overflow condition may allow ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-07

GMOD Apollo

Title

GMOD Apollo

Published

March 4, 2025, 1 p.m.

URL

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: GMOD Equipment: Apollo Vulnerabilities: Incorrect Privilege Assignment, Relative Path Traversal, Missing Authentication for Critical Function, Generation of Error Message Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate ...

Edimax IC-7100 IP Camera

Title

Edimax IC-7100 IP Camera

Published

March 4, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Edimax Equipment: IC-7100 IP Camera Vulnerability: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send ...

Hitachi Energy MACH PS700

Title

Hitachi Energy MACH PS700

Published

March 4, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-03

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.7 ATTENTION: Vendor: Hitachi Energy Equipment: MACH PS700 Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate privileges and gain control over the software. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Hitachi Energy reports ...

Hitachi Energy UNEM/ECST

Title

Hitachi Energy UNEM/ECST

Published

March 4, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-05

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Low Attack Complexity Vendor: Hitachi Energy Equipment: XMC20, ECST, UNEM Vulnerability: Improper Validation of Certificate with Host Mismatch 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to intercept or falsify data exchanges between the client and the server. ...

February 2025

27.02.2025

Schneider Electric Communication Modules for Modicon M580 and Quantum Controllers

Title

Schneider Electric Communication Modules for Modicon M580 and Quantum Controllers

Published

Feb. 27, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-058-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Communication modules for Modicon M580 and Quantum controllers Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a stack overflow attack, which could result in loss of confidentiality, integrity, ...

25.02.2025

Rockwell Automation PowerFlex 755

Title

Rockwell Automation PowerFlex 755

Published

Feb. 25, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-056-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Rockwell Automation Equipment: PowerFlex 755 Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could result in exposure of sensitive data. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following version of ...

Rapid Response Monitoring My Security Account App

Title

Rapid Response Monitoring My Security Account App

Published

Feb. 20, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-05

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rapid Response Monitoring Equipment: My Security Account App Vulnerability: Authorization Bypass Through User-Controlled Key 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attacker to access sensitive information of other users. 3. TECHNICAL DETAILS 3.1 ...

ABB ASPECT-Enterprise, NEXUS, and MATRIX Series

Title

ABB ASPECT-Enterprise, NEXUS, and MATRIX Series

Published

Feb. 20, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: ASPECT-Enterprise, NEXUS, and MATRIX series Vulnerability: Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain access to devices without proper authentication. 3. TECHNICAL DETAILS 3.1 ...

Elseta Vinci Protocol Analyzer

Title

Elseta Vinci Protocol Analyzer

Published

Feb. 20, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-06

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Elseta Equipment: Vinci Protocol Analyzer Vulnerability: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate privileges and perform ...

ABB FLXEON Controllers

Title

ABB FLXEON Controllers

Published

Feb. 20, 2025, 1 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-02

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: FLXEON Controllers Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), Missing Origin Validation in WebSockets, Insertion of Sensitive Information into Log File 2. RISK EVALUATION Successful exploitation ...

https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-03

Carrier Block Load

Title

Carrier Block Load

Published

Feb. 20, 2025, 1 p.m.

URL

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Carrier Equipment: Block Load Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a malicious actor to execute arbitrary code with escalated privileges . 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...

13.02.2025

https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-08

Siemens OpenV2G

Title

Siemens OpenV2G

Published

Feb. 13, 2025, 1 p.m.

URL

Summary

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

13.02.2025