Bulletins | CERT@VDE

Delta Electronics DTN Soft

Title

Delta Electronics DTN Soft

Published

Aug. 29, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-242-02

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DTN Soft Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ...

Rockwell Automation Emulate3D

Title

Rockwell Automation Emulate3D

Published

Aug. 22, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.4 ATTENTION: Exploitable locally Vendor: Rockwell Automation Equipment: Emulate3D Vulnerability: Externally Controlled Reference to a Resource in Another Sphere 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

Rockwell Automation 5015 - AENFTXT

Title

Rockwell Automation 5015 - AENFTXT

Published

Aug. 22, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-02

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: 5015 - AENFTXT Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Rockwell Automation 5015 ...

MOBOTIX P3 and Mx6 Cameras

Title

MOBOTIX P3 and Mx6 Cameras

Published

Aug. 22, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-03

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: MOBOTIX Equipment: P3 Cameras, Mx6 Cameras Vulnerability: Improper Neutralization of Expression/Command Delimiters 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an authenticated attacker to achieve remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-04

Avtec Outpost 0810

Title

Avtec Outpost 0810

Published

Aug. 22, 2024, 2 p.m.

URL

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Avtec Equipment: Outpost 0810, Outpost Uploader Utility Vulnerability: Storage of File with Sensitive Data Under Web Root, Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain ...

Siemens LOGO! V8.3 BM Devices

Title

Siemens LOGO! V8.3 BM Devices

Published

Aug. 15, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-05

Summary

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Siemens Location Intelligence

Title

Siemens Location Intelligence

Published

Aug. 15, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-07

Summary

Siemens SCALANCE M-800, RUGGEDCOM RM1224

Title

Siemens SCALANCE M-800, RUGGEDCOM RM1224

Published

Aug. 15, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-01

Summary

AVEVA Historian Web Server

Title

AVEVA Historian Web Server

Published

Aug. 15, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-10

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: Historian Server Vulnerability: SQL Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated user to get read and write access to the database. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The ...

PTC Kepware ThingWorx Kepware Server

Title

PTC Kepware ThingWorx Kepware Server

Published

Aug. 15, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-11

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable from adjacent network. Vendor: PTC Equipment: Kepware ThingWorx Kepware Server Vulnerability: Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the target device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS PTC reports that ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-02

Siemens INTRALOG WMS

Title

Siemens INTRALOG WMS

Published

Aug. 15, 2024, 2 p.m.

URL

Summary

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380

Title

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-09

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow and attacker to cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED ...

Rockwell Automation GuardLogix/ControlLogix 5580 Controller

Title

Rockwell Automation GuardLogix/ControlLogix 5580 Controller

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-03

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ControlLogix 5580, GuardLogix 5580 Vulnerability: Improper Check for Unusual or Exceptional Conditions 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a denial-of-service on the device. 3. TECHNICAL ...

Rockwell Automation DataMosaix Private Cloud

Title

Rockwell Automation DataMosaix Private Cloud

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-05

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: DataMosaix Private Cloud Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to generate cookies for a user ID without the use of a username or password, ...

Rockwell Automation AADvance Standalone OPC-DA Server

Title

Rockwell Automation AADvance Standalone OPC-DA Server

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-02

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: AADvance Standalone OPC-DA Server Vulnerabilities: Improper Input Validation, Use of Externally Controlled Format String 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code in the affected ...

Ocean Data Systems Dream Report

Title

Ocean Data Systems Dream Report

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-08

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Ocean Data Systems Equipment: Dream Report 2023 Vulnerabilities: Path Traversal, Incorrect Permission Assignment for Critical Resource 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform remote code execution or escalate their ...

Rockwell Automation Micro850/870

Title

Rockwell Automation Micro850/870

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-07

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Micro850/870 Vulnerability: Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability may cause CIP/Modbus communication to be disrupted for short duration. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Rockwell Automation reports that ...

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380

Title

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-10

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, Compact GuardLogix 5380, CompactLogix 5480 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device being accessed. 3. TECHNICAL DETAILS 3.1 ...

AVEVA SuiteLink Server

Title

AVEVA SuiteLink Server

Published

Aug. 13, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: SuiteLink Server Vulnerability: Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause the server to consume excessive system resources, preventing processing of ...

08.08.2024

Dorsett Controls InfoScan

Title

Dorsett Controls InfoScan

Published

Aug. 8, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-221-01

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Dorsett Controls Equipment: InfoScan Vulnerabilities: Exposure of Sensitive Information To An Unauthorized Actor, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to expose sensitive information, resulting in data theft and ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-07

AVTECH IP Camera

Title

AVTECH IP Camera

Published

Aug. 1, 2024, 2 p.m.

URL

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: AVTECH SECURITY Corporation Equipment: IP camera Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to inject and execute commands as the owner of the ...

Johnson Controls exacqVision Server Web Service

Title

Johnson Controls exacqVision Server Web Service

Published

Aug. 1, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-02

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.6 ATTENTION: Exploitable remotely Vendor: Johnson Controls Inc. Equipment: exacqVision Web Service Vulnerability: Permissive Cross-domain Policy with Untrusted Domains 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to send an unauthorized request or access data from an untrusted domain. ...

https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08

Vonets WiFi Bridges

Title

Vonets WiFi Bridges

Published

Aug. 1, 2024, 2 p.m.

URL

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Vonets Equipment: VAR1200-H, VAR1200-L, VAR600-H, VAP11AC, VAP11G-500S, VBG1200, VAP11S-5G, VAP11S, VAR11N-300, VAP11G-300, VAP11N-300, VAP11G, VAP11G-500, VBG1200, VAP11AC, VGA-1000 Vulnerabilities: Use of Hard-coded Credentials, Improper Access Control, Path Traversal, Command Injection, Improper Check or Handling of Exceptional ...

Johnson Controls exacqVision Web Service

Title

Johnson Controls exacqVision Web Service

Published

Aug. 1, 2024, 2 p.m.

URL

https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-04

Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.4 ATTENTION: Exploitable remotely Vendor: Johnson Controls, Inc. Equipment: exacqVision Web Service Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform a man-in-the-middle attack and gain access to sensitive information. 3. TECHNICAL ...