Bulletins | CERT@VDE

Schneider Electric Rack PDU (Update A)

Title

Schneider Electric Rack PDU (Update A)

Published

Dec. 21, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-348-02

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-21-348-02 Schneider Electric Rack PDU that was published December 14, 2021, to the ICS webpage on www.cisa.gov/uscert. This advisory contains mitigations for an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Schneider Electric Rack Power Distribution Unit ...

17.12.2021

Siemens SINUMERIK Edge

Title

Siemens SINUMERIK Edge

Published

Dec. 17, 2021, 4:36 a.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-09

Summary

This advisory contains mitigations for an Improper Certificate Validation vulnerability in the Siemens SINUMERIK Edge hardware and software digital production support and optimization platform.

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-01

Xylem AquaView

Title

Xylem AquaView

Published

Dec. 16, 2021, 4:52 p.m.

URL

Summary

This advisory contains mitigations for a Use of Hard-coded Credentials vulnerability in the Xylem AquaView SCADA system.

Wibu-Systems CodeMeter Runtime

Title

Wibu-Systems CodeMeter Runtime

Published

Dec. 16, 2021, 4:48 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-03

Summary

This advisory contains mitigations for an Improper Privilege Management vulnerability in the Wibu-Systems CodeMeter Runtime server.

Mitsubishi Electric GX Works2

Title

Mitsubishi Electric GX Works2

Published

Dec. 16, 2021, 4:46 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-04

Summary

This advisory contains mitigations for an Improper Handling of Length Parameter Inconsistency vulnerability in #Mitsubishi Electric's GX Works2 engineering software.

Mitsubishi Electric FA Engineering Software

Title

Mitsubishi Electric FA Engineering Software

Published

Dec. 16, 2021, 4:44 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05

Summary

This advisory contains mitigations for Out-of-bounds Read, and Integer Underflow vulnerabilities in Mitsubishi Electric's FA Engineering Software engineering software.

Siemens Capital VSTAR

Title

Siemens Capital VSTAR

Published

Dec. 16, 2021, 4:42 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-06

Summary

This advisory contains mitigations for a several vulnerabilities in Siemens Capital VSTAR software platform products using Nucleus NET, the networking stack of Nucleus RTOS (real-time operating system).

Siemens POWER METER SICAM Q100

Title

Siemens POWER METER SICAM Q100

Published

Dec. 16, 2021, 4:40 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-07

Summary

This advisory contains mitigations for a Stack-based Buffer Overflow vulnerability in the Siemens POWER METER SICAM Q100 power monitoring device.

Siemens JTTK and JT Utilities

Title

Siemens JTTK and JT Utilities

Published

Dec. 16, 2021, 4:38 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-08

Summary

This advisory contains mitigations for Out-of-bounds Write, Use after Free, Out-of-bounds Read vulnerability in in the Siemens JTTK programming interface, and JT Utilities series of command line utilities.

14.12.2021

Schneider Electric Rack PDU

Title

Schneider Electric Rack PDU

Published

Dec. 14, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-348-02

Summary

This advisory contains mitigations for a Cross-site Scripting vulnerability in Schneider Electric Rack Power Distribution Unit (PDU).

14.12.2021

Hillrom Medical Device Management (Update A)

Title

Hillrom Medical Device Management (Update A)

Published

Dec. 14, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-152-01

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-21-152-01 Hillrom Medical Device Management that was published June 1, 2021, to the ICS webpage at www.cisa.gov/uscert. This advisory contains mitigations for a Out-of-Bounds Write, an d Out-of-Bounds Read vulnerabilities in Hillrom Welch Allyn medical device management tools.

09.12.2021

Hillrom Welch Allyn Cardio Products

Title

Hillrom Welch Allyn Cardio Products

Published

Dec. 9, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-343-01

Summary

This advisory contains mitigations for an Authentication Bypass Using an Alternate Path or Channel vulnerability in Hillrom Welch Allyn cardiology devices.

09.12.2021

Hitachi Energy GMS600, PWC600, and Relion

Title

Hitachi Energy GMS600, PWC600, and Relion

Published

Dec. 9, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-343-01

Summary

This advisory contains mitigations for an Improper Access Controls vulnerability in Hitachi Energy GMS600, PWC600, and Relion circuit breaker monitoring systems.

07.12.2021

Hitachi Energy RTU500 OpenLDAP

Title

Hitachi Energy RTU500 OpenLDAP

Published

Dec. 7, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-341-01

Summary

This advisory contains mitigations for Type Confusion, and Reachable Assertion vulnerabilities in Hitachi Energy RTU500 OpenLDAP firmware.

07.12.2021

Hitachi Energy XMC20 and FOX61x

Title

Hitachi Energy XMC20 and FOX61x

Published

Dec. 7, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-341-02

Summary

This advisory contains mitigations for Weak Password Requirements, and Missing Handler vulnerabilities in Hitachi Energy XMC20 and FOX61x multi-service network elements.

07.12.2021

FANUC Robot Controllers

Title

FANUC Robot Controllers

Published

Dec. 7, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-243-02

Summary

This advisory is a follow-up to the original advisory titled ICSA-21-243-02P FANUC Robot Controllers that was posted to the HSIN ICS library on August 31, 2021. This advisory contains mitigations for Integer Coercion Error, and Out-of-bounds Write vulnerabilities in FANUC Robot Controllers.

Schneider Electric SESU

Title

Schneider Electric SESU

Published

Dec. 2, 2021, 4:35 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-01

Summary

This advisory contains mitigations for an Insufficient Entropy vulnerability in the Schneider Electric Software Update.

Johnson Controls Entrapass

Title

Johnson Controls Entrapass

Published

Dec. 2, 2021, 4:30 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-02

Summary

This advisory contains mitigations for a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Johnson Controls Entrapass security management software.

Distributed Data Systems WebHMI

Title

Distributed Data Systems WebHMI

Published

Dec. 2, 2021, 4:25 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03

Summary

This advisory contains mitigations for Authentication Bypass by Primary Weakness, and Unrestricted Upload of File with Dangerous Type vulnerabilities in Distributed Data Systems WebHMI SCADA systems.

Hitachi Energy RTU500 series BCI

Title

Hitachi Energy RTU500 series BCI

Published

Dec. 2, 2021, 4:20 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-04

Summary

This advisory contains mitigations for an Improper Input Validation vulnerability in Hitachi Energy RTU500 series BCI remote terminal units.

Hitachi Energy Relion 670/650/SAM600-IO

Title

Hitachi Energy Relion 670/650/SAM600-IO

Published

Dec. 2, 2021, 4:15 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-05

Summary

This advisory contains mitigations for an Insecure Default Initialization of Resource vulnerability in Hitachi Energy Relion 670/650/SAM600-IO Intelligent Electronic Devices (IEDs).

Hitachi Energy APM Edge

Title

Hitachi Energy APM Edge

Published

Dec. 2, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-06

Summary

This advisory contains mitigations for a Using Components with Known Vulnerabilities vulnerability in Hitachi Energy Transformer Asset Performance Management (APM) Edge software.

Hitachi Energy PCM600 Update Manager

Title

Hitachi Energy PCM600 Update Manager

Published

Dec. 2, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-07

Summary

This advisory contains mitigations for a Improper Certificate Validation vulnerability in Hitachi Energy PCM600 Update Manager protection and control IED software.

Hitachi Energy RTU500 series

Title

Hitachi Energy RTU500 series

Published

Dec. 2, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-08

Summary

This advisory contains mitigations for Observable Discrepancy, Buffer Over-read, and Out-of-bounds Read vulnerabilities in Hitachi Energy RTU500 remote terminal units.

November 2021

30.11.2021