March 2023
23.03.2023
US CERT (ICS)
CP Plus KVMS Pro
Title
CP Plus KVMS Pro
Published
March 23, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-02
Summary
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: CP Plus Equipment: KVMS Pro Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to retrieve sensitive credentials and control the entire CCTV system. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following ...
21.03.2023
US CERT (ICS)
Siemens RUGGEDCOM APE1808 Product Family
Title
Siemens RUGGEDCOM APE1808 Product Family
Published
March 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-03
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 1. EXECUTIVE SUMMARY CVSS v3 ...
21.03.2023
US CERT (ICS)
Keysight N6845A Geolocation Server
Title
Keysight N6845A Geolocation Server
Published
March 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-01
Summary
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Keysight Technologies Equipment: N6854A Geolocation Sever Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate privileges in the affected device’s default configuration, resulting in remote code execution or deleting ...
21.03.2023
US CERT (ICS)
Rockwell Automation ThinManager
Title
Rockwell Automation ThinManager
Published
March 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-06
Summary
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ThinManager ThinServer Vulnerabilities: Path Traversal, Heap-Based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to potentially perform remote code execution on the target system/device or crash the software. 3. ...
21.03.2023
US CERT (ICS)
VISAM VBASE Automation Base
Title
VISAM VBASE Automation Base
Published
March 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
Summary
1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: VISAM Equipment: VBASE Vulnerabilities: Improper Restriction of XML External Entity Reference 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information from the target device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS VISAM reports ...
21.03.2023
US CERT (ICS)
Siemens RADIUS Client of SIPROTEC 5 Devices
Title
Siemens RADIUS Client of SIPROTEC 5 Devices
Published
March 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-04
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 1. EXECUTIVE SUMMARY CVSS v3 ...
21.03.2023
US CERT (ICS)
Siemens SCALANCE Third-Party
Title
Siemens SCALANCE Third-Party
Published
March 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-07
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 1. EXECUTIVE SUMMARY CVSS v3 ...
16.03.2023
US CERT (ICS)
Siemens RUGGEDCOM CROSSBOW V5.2
Title
Siemens RUGGEDCOM CROSSBOW V5.2
Published
March 16, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-03
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 1. EXECUTIVE SUMMARY CVSS v3 ...
16.03.2023
US CERT (ICS)
Siemens SCALANCE, RUGGEDCOM Third-Party
Title
Siemens SCALANCE, RUGGEDCOM Third-Party
Published
March 16, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-01
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 1. EXECUTIVE SUMMARY CVSS v3 ...
16.03.2023
US CERT (ICS)
Siemens SCALANCE W1750D Devices
Title
Siemens SCALANCE W1750D Devices
Published
March 16, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-04
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 1. EXECUTIVE SUMMARY CVSS v3 ...
16.03.2023
US CERT (ICS)
Siemens RUGGEDCOM CROSSBOW V5.3
Title
Siemens RUGGEDCOM CROSSBOW V5.3
Published
March 16, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-02
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 1. EXECUTIVE SUMMARY CVSS v3 ...
16.03.2023
US CERT (ICS)
Rockwell Automation Modbus TCP AOI Server
Title
Rockwell Automation Modbus TCP AOI Server
Published
March 16, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-07
Summary
1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Modbus TCP Server Add-On Instruction (AOI) Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized user to read the connected device’s Modbus TCP ...
16.03.2023
US CERT (ICS)
Honeywell OneWireless Wireless Device Manager
Title
Honeywell OneWireless Wireless Device Manager
Published
March 16, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-06
Summary
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: OneWireless Wireless Device Manager (WDM) Vulnerabilities: Command Injection, Use of Insufficiently Random Values, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of these vulnerabilities could disclose sensitive information, allow privilege escalation, or allow remote ...
14.03.2023
US CERT (ICS)
Omron CJ1M PLC
Title
<a href="/news-events/ics-advisories/icsa-23-073-01" hreflang="en">Omron CJ1M PLC</a>
Published
March 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-01
Summary
1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Omron Equipment: CJ1M PLC Vulnerabilities: Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to bypass user memory protections by writing to a specific memory address. An attacker can also overwrite passwords ...
14.03.2023
US CERT (ICS)
Autodesk FBX SDK
Title
Autodesk FBX SDK
Published
March 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-02
Summary
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Autodesk Equipment: FBX SDK Vulnerability: Out-of-bounds Read, Use After Free, Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to code execution or a denial-of-service condition. Products using Autodesk FBX SDK software are affected by ...
14.03.2023
US CERT (ICS)
GE iFIX
Title
<a href="/news-events/ics-advisories/icsa-23-073-03" hreflang="en">GE iFIX</a>
Published
March 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03
Summary
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: GE Digital Equipment: iFIX Vulnerability: Code Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for privilege escalation and full control of the system. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following components of iFIX, a human ...
14.03.2023
US CERT (ICS)
AVEVA Plant SCADA and AVEVA Telemetry Server
Title
<a href="/news-events/ics-advisories/icsa-23-073-04" hreflang="en">AVEVA Plant SCADA and AVEVA Telemetry Server</a>
Published
March 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04
Summary
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: AVEVA Plant SCADA and AVEVA Telemetry Server Vulnerability: Improper Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated user to read data, cause a denial of service, and tamper with alarm states. ...
14.03.2023
US CERT (ICS)
AVEVA Plant SCADA and AVEVA Telemetry Server
Title
AVEVA Plant SCADA and AVEVA Telemetry Server
Published
March 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-04
Summary
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: AVEVA Plant SCADA and AVEVA Telemetry Server Vulnerability: Improper Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated user to read data, cause a denial of service, and tamper with alarm states. ...
14.03.2023
US CERT (ICS)
Autodesk FBX SDK
Title
<a href="/news-events/ics-advisories/icsa-23-073-02" hreflang="en">Autodesk FBX SDK</a>
Published
March 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-02
Summary
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Autodesk Equipment: FBX SDK Vulnerability: Out-of-bounds Read, Use After Free, Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to code execution or a denial-of-service condition. Products using Autodesk FBX SDK software are affected by ...
14.03.2023
US CERT (ICS)
Omron CJ1M PLC
Title
Omron CJ1M PLC
Published
March 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-01
Summary
1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Omron Equipment: CJ1M PLC Vulnerabilities: Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to bypass user memory protections by writing to a specific memory address. An attacker can also overwrite passwords ...
09.03.2023
US CERT (ICS)
ABB Ability Symphony Plus
Title
<a href="/news-events/ics-advisories/icsa-23-068-03" hreflang="en">ABB Ability Symphony Plus</a>
Published
March 9, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-03
Summary
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low attack complexity Vendor: ABB Equipment: Ability Symphony Plus Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized client to connect to the S+ Operations servers (human machine interface (HMI) network), to act as a legitimate S+ ...
09.03.2023
US CERT (ICS)
Hitachi Energy Relion 670, 650 and SAM600-IO Series
Title
<a href="/news-events/ics-advisories/icsa-23-068-05" hreflang="en">Hitachi Energy Relion 670, 650 and SAM600-IO Series</a>
Published
March 9, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-05
Summary
1. EXECUTIVE SUMMARY CVSS v3 4.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Relion 670, 650, and SAM600-IO Series Vulnerability: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could cause the Intelligent Electronic Device (IED) to restart, causing a temporary denial-of-service condition. 3. ...
09.03.2023
US CERT (ICS)
B&R Systems Diagnostics Manager
Title
<a href="/news-events/ics-advisories/icsa-23-068-02" hreflang="en">B&amp;R Systems Diagnostics Manager</a>
Published
March 9, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-02
Summary
1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: B&R Industrial Automation Equipment: Systems Diagnostics Manager (SDM) Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code to exfiltrate data and perform any action within ...
09.03.2023
US CERT (ICS)
Step Tools Third-Party
Title
<a href="/news-events/ics-advisories/icsa-23-068-04" hreflang="en">Step Tools Third-Party</a>
Published
March 9, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04
Summary
1. EXECUTIVE SUMMARY CVSS v3 2.2 ATTENTION: Low attack complexity Vendor: Step Tools, Inc Equipment: STEPTools ifcmesh library Vulnerability: Null Pointer Dereference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to deny application usage when reading a specially constructed file. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...
09.03.2023
US CERT (ICS)
Akuvox E11
Title
<a href="/news-events/ics-advisories/icsa-23-068-01" hreflang="en">Akuvox E11</a>
Published
March 9, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
Summary
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Akuvox Equipment: E11 Vulnerabilities: Generation of Predictable IV with CBC, User of Hard-coded Cryptographic Key, Missing Authentication for Critical Function, Storing Passwords in a Recoverable Format, Weak Password Recovery Mechanism for Forgotten Password, Command Injection, Reliance on File ...

Last Updates

BOSCH PSIRT
21.08.2024
SIEMENS CERT
12.09.2024
US CERT
19.09.2024
US CERT (ICS)
19.09.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds