Bulletins | CERT@VDE

Siemens Capital VSTAR

Title

Siemens Capital VSTAR

Published

Dec. 16, 2021, 4:42 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-06

Summary

This advisory contains mitigations for a several vulnerabilities in Siemens Capital VSTAR software platform products using Nucleus NET, the networking stack of Nucleus RTOS (real-time operating system).

16.12.2021

Siemens POWER METER SICAM Q100

Title

Siemens POWER METER SICAM Q100

Published

Dec. 16, 2021, 4:40 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-07

Summary

This advisory contains mitigations for a Stack-based Buffer Overflow vulnerability in the Siemens POWER METER SICAM Q100 power monitoring device.

16.12.2021

Siemens JTTK and JT Utilities

Title

Siemens JTTK and JT Utilities

Published

Dec. 16, 2021, 4:38 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-350-08

Summary

This advisory contains mitigations for Out-of-bounds Write, Use after Free, Out-of-bounds Read vulnerability in in the Siemens JTTK programming interface, and JT Utilities series of command line utilities.

14.12.2021

Schneider Electric Rack PDU

Title

Schneider Electric Rack PDU

Published

Dec. 14, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-348-02

Summary

This advisory contains mitigations for a Cross-site Scripting vulnerability in Schneider Electric Rack Power Distribution Unit (PDU).

14.12.2021

Hillrom Medical Device Management (Update A)

Title

Hillrom Medical Device Management (Update A)

Published

Dec. 14, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-152-01

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-21-152-01 Hillrom Medical Device Management that was published June 1, 2021, to the ICS webpage at www.cisa.gov/uscert. This advisory contains mitigations for a Out-of-Bounds Write, an d Out-of-Bounds Read vulnerabilities in Hillrom Welch Allyn medical device management tools.

09.12.2021

Hillrom Welch Allyn Cardio Products

Title

Hillrom Welch Allyn Cardio Products

Published

Dec. 9, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsma-21-343-01

Summary

This advisory contains mitigations for an Authentication Bypass Using an Alternate Path or Channel vulnerability in Hillrom Welch Allyn cardiology devices.

09.12.2021

Hitachi Energy GMS600, PWC600, and Relion

Title

Hitachi Energy GMS600, PWC600, and Relion

Published

Dec. 9, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-343-01

Summary

This advisory contains mitigations for an Improper Access Controls vulnerability in Hitachi Energy GMS600, PWC600, and Relion circuit breaker monitoring systems.

07.12.2021

Hitachi Energy RTU500 OpenLDAP

Title

Hitachi Energy RTU500 OpenLDAP

Published

Dec. 7, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-341-01

Summary

This advisory contains mitigations for Type Confusion, and Reachable Assertion vulnerabilities in Hitachi Energy RTU500 OpenLDAP firmware.

07.12.2021

Hitachi Energy XMC20 and FOX61x

Title

Hitachi Energy XMC20 and FOX61x

Published

Dec. 7, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-341-02

Summary

This advisory contains mitigations for Weak Password Requirements, and Missing Handler vulnerabilities in Hitachi Energy XMC20 and FOX61x multi-service network elements.

07.12.2021

FANUC Robot Controllers

Title

FANUC Robot Controllers

Published

Dec. 7, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-243-02

Summary

This advisory is a follow-up to the original advisory titled ICSA-21-243-02P FANUC Robot Controllers that was posted to the HSIN ICS library on August 31, 2021. This advisory contains mitigations for Integer Coercion Error, and Out-of-bounds Write vulnerabilities in FANUC Robot Controllers.

Schneider Electric SESU

Title

Schneider Electric SESU

Published

Dec. 2, 2021, 4:35 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-01

Summary

This advisory contains mitigations for an Insufficient Entropy vulnerability in the Schneider Electric Software Update.

Johnson Controls Entrapass

Title

Johnson Controls Entrapass

Published

Dec. 2, 2021, 4:30 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-02

Summary

This advisory contains mitigations for a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Johnson Controls Entrapass security management software.

Distributed Data Systems WebHMI

Title

Distributed Data Systems WebHMI

Published

Dec. 2, 2021, 4:25 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03

Summary

This advisory contains mitigations for Authentication Bypass by Primary Weakness, and Unrestricted Upload of File with Dangerous Type vulnerabilities in Distributed Data Systems WebHMI SCADA systems.

Hitachi Energy RTU500 series BCI

Title

Hitachi Energy RTU500 series BCI

Published

Dec. 2, 2021, 4:20 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-04

Summary

This advisory contains mitigations for an Improper Input Validation vulnerability in Hitachi Energy RTU500 series BCI remote terminal units.

Hitachi Energy Relion 670/650/SAM600-IO

Title

Hitachi Energy Relion 670/650/SAM600-IO

Published

Dec. 2, 2021, 4:15 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-05

Summary

This advisory contains mitigations for an Insecure Default Initialization of Resource vulnerability in Hitachi Energy Relion 670/650/SAM600-IO Intelligent Electronic Devices (IEDs).

Hitachi Energy APM Edge

Title

Hitachi Energy APM Edge

Published

Dec. 2, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-06

Summary

This advisory contains mitigations for a Using Components with Known Vulnerabilities vulnerability in Hitachi Energy Transformer Asset Performance Management (APM) Edge software.

Hitachi Energy PCM600 Update Manager

Title

Hitachi Energy PCM600 Update Manager

Published

Dec. 2, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-07

Summary

This advisory contains mitigations for a Improper Certificate Validation vulnerability in Hitachi Energy PCM600 Update Manager protection and control IED software.

Hitachi Energy RTU500 series

Title

Hitachi Energy RTU500 series

Published

Dec. 2, 2021, 4 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-336-08

Summary

This advisory contains mitigations for Observable Discrepancy, Buffer Over-read, and Out-of-bounds Read vulnerabilities in Hitachi Energy RTU500 remote terminal units.

November 2021

Xylem Aanderaa GeoView

Title

Xylem Aanderaa GeoView

Published

Nov. 30, 2021, 4:30 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-01

Summary

This advisory contains mitigations for a SQL Injection vulnerability in the Xylem Aanderaa GeoView web-based data display.

Mitsubishi Electric MELSEC and MELIPC Series

Title

Mitsubishi Electric MELSEC and MELIPC Series

Published

Nov. 30, 2021, 4:25 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02

Summary

This advisory contains mitigations for Uncontrolled Resource Consumption, Improper Handling of Length Parameter Inconsistency, and Improper Input Validation vulnerabilities in Mitsubishi Electric MELSEC and MELIPC Series software management platforms.

Delta Electronics CNCSoft

Title

Delta Electronics CNCSoft

Published

Nov. 30, 2021, 4:20 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-03

Summary

This advisory contains mitigations for a Stack-based Buffer Overflow vulnerability in the Delta Electronics CNCSoft sofware management platform.

Johnson Controls CEM Systems AC2000

Title

Johnson Controls CEM Systems AC2000

Published

Nov. 30, 2021, 4:15 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-04

Summary

This advisory contains mitigations for an Off-by-one Error vulnerability in the Johnson Controls CEM Systems AC2000 access control system.

Hitachi Energy Retail Operations and CSB Software

Title

Hitachi Energy Retail Operations and CSB Software

Published

Nov. 30, 2021, 4:10 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-05

Summary

This advisory contains mitigations for an Improper Access Control vulnerability in Hitachi Energy Retail Operations and CSB Software systems.

InHand Networks IR615 Router (Update A)

Title

InHand Networks IR615 Router (Update A)

Published

Nov. 30, 2021, 4:05 p.m.

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-21-280-05 InHand Networks IR615 Router that was published October 7, 2021, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for numerous vulnerabilities in the InHand Networks IR615 Router.