Bulletins | CERT@VDE

https://www.us-cert.gov/ics/advisories/icsa-20-119-01

LCDS LAquis SCADA

Title

LCDS LAquis SCADA

Published

April 28, 2020, 4 p.m.

URL

Summary

This advisory contains mitigations for exposure of sensitive information to an unauthorized actor, and improper input validation vulnerabilities in LCDS's LAquis SCADA software.

23.04.2020

Sierra Wireless AirLink ALEOS (Update B)

Title

Sierra Wireless AirLink ALEOS (Update B)

Published

April 23, 2020, 4 p.m.

URL

https://www.us-cert.gov/ics/advisories/ICSA-19-122-03

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-19-122-03 Sierra Wireless AirLink ALEOS (Update A) that was published August 20, 2019, to the ICS webpage on us-cert.gov. This updated advisory includes mitigations for OS command injection, use of hard-coded credentials, unrestricted upload of file with dangerous type, ...

21.04.2020

Inductive Automation Ignition

Title

Inductive Automation Ignition

Published

April 21, 2020, 4 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-112-01

Summary

This advisory contains mitigations for an improper access control vulnerability in Inductive Automation's Ignition 8 Gateway web server software.

https://www.us-cert.gov/ics/advisories/icsa-20-105-01

Eaton HMiSoft VU3

Title

Eaton HMiSoft VU3

Published

April 14, 2020, 5:05 p.m.

URL

Summary

This advisory contains mitigations for stack-based buffer overflow and out-of-bounds read vulnerabilities in Eaton's HMiSoft VU3 human-machine interface (HMI).

Triangle MicroWorks DNP3 Outstation Libraries

Title

Triangle MicroWorks DNP3 Outstation Libraries

Published

April 14, 2020, 5 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-02

Summary

This advisory contains mitigations for a stack-based buffer overflow vulnerability in Triangle MicroWorks DNP3 components and source code libraries.

Triangle MicroWorks SCADA Data Gateway

Title

Triangle MicroWorks SCADA Data Gateway

Published

April 14, 2020, 4:55 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-03

Summary

This advisory contains mitigations for stack-based buffer overflow, out-of-bounds read, and type confusion vulnerabilities in the Triangle MicroWorks SCADA Data Gateway.

https://www.us-cert.gov/ics/advisories/icsa-20-105-04

Siemens Climatix

Title

Siemens Climatix

Published

April 14, 2020, 4:50 p.m.

URL

Summary

This advisory contains mitigations for cross-site scripting and basic XSS vulnerabilities in Siemens Climatix controllers.

Siemens IE/PB-Link, RUGGEDCOM, SCALANCE, SIMATIC, SINEMA

Title

Siemens IE/PB-Link, RUGGEDCOM, SCALANCE, SIMATIC, SINEMA

Published

April 14, 2020, 4:45 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-05

Summary

This advisory contains mitigations for uncontrolled resource consumption and improper input validation vulnerabilities in Siemens IE/PB-Link, RUGGEDCOM, SCALANCE, SIMATIC, and SINEMA products.

Siemens SIMOTICS, Desigo, APOGEE, and TALON

Title

Siemens SIMOTICS, Desigo, APOGEE, and TALON

Published

April 14, 2020, 4:40 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-06

Summary

This advisory contains mitigations for a business logic errors vulnerability in Siemens' SIMOTICS, Desigo, APOGEE, and TALON products.

Siemens SCALANCE & SIMATIC

Title

Siemens SCALANCE & SIMATIC

Published

April 14, 2020, 4:35 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-07

Summary

This advisory contains mitigations for a resource exhaustion vulnerability in Siemens' SCALANCE and SIMATIC products.

Siemens KTK, SIDOOR, SIMATIC, and SINAMICS

Title

Siemens KTK, SIDOOR, SIMATIC, and SINAMICS

Published

April 14, 2020, 4:30 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-08

Summary

This advisory contains mitigations for an uncontrolled resource consumption vulnerability in Siemens' KTN, SIDOOR, SIMATIC, and SINAMICS products.

Siemens TIM 3V-IE and 4R-IE Family Devices

Title

Siemens TIM 3V-IE and 4R-IE Family Devices

Published

April 14, 2020, 4:25 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-105-09

Summary

This advisory contains mitigations for an active debug code vulnerability in Siemens TIM 3V-IE and 4R-IE Family Devices.

Siemens SIMATIC S7 (Update B)

Title

Siemens SIMATIC S7 (Update B)

Published

April 14, 2020, 4:20 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-042-05

Summary

This updated advisory is a follow-up to the advisory update titled ICSA-20-042-05 Siemens SIMATIC S7 (Update A) that was published March 10, 2020, to the ICS webpage on us-cert.gov. This advisory contains mitigations for a resource exhaustion vulnerability in Siemens SIMATIC S7 devices.

Advantech WebAccess/NMS

Title

Advantech WebAccess/NMS

Published

April 7, 2020, 4:25 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-098-01

Summary

This advisory contains mitigations for multiple vulnerabilities in Advantech's WebAccess/NMS network management system.

GE Digital CIMPLICITY

Title

GE Digital CIMPLICITY

Published

April 7, 2020, 4:20 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-098-02

Summary

This advisory contains mitigations for a privilege escalation vulnerability in GE Digital CIMPLICITY HMI/SCADA products.

HMS Networks eWON Flexy and Cosy

Title

HMS Networks eWON Flexy and Cosy

Published

April 7, 2020, 4:15 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-098-03

Summary

This advisory contains mitigations for a cross-site scripting vulnerability in HMS Networks eWON Flexy and Cosy Industrial VPN routers.

https://www.us-cert.gov/ics/advisories/icsa-20-098-05

KUKA.Sim Pro

Title

KUKA.Sim Pro

Published

April 7, 2020, 4:05 p.m.

URL

Summary

This advisory contains mitigations for a ### vulnerability in ###, a ###

Synergy Systems & Solutions HUSKY RTU (Update A)

Title

Synergy Systems & Solutions HUSKY RTU (Update A)

Published

April 7, 2020, 4 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-042-01

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-20-042-01 Synergy Systems & Solutions HUSKY RTU that was published February 11, 2020, to the ICS webpage on us-cert.gov. This advisory contains mitigations for improper authentication and improper input validation vulnerabilities in Synergy Systems & Solutions HUSKY RTU, a ...

02.04.2020

B&R Automation Studio

Title

B&R Automation Studio

Published

April 2, 2020, 4 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-093-01

Summary

This advisory contains mitigations for improper privilege management, missing required cryptographic step, and path traversal vulnerabilities in B&R Automation Studio software.

March 2020

BD Pyxis MedStation and Pyxis Anesthesia (PAS) ES System

Title

BD Pyxis MedStation and Pyxis Anesthesia (PAS) ES System

Published

March 31, 2020, 4:15 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsma-20-091-01

Summary

This advisory contains mitigations for a protection mechanism failure vulnerability in BD Pyxis medical devices.

Hirschmann Automation and Control HiOS and HiSecOS Products

Title

Hirschmann Automation and Control HiOS and HiSecOS Products

Published

March 31, 2020, 4:10 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-091-01

Summary

This advisory contains mitigations for a classic buffer overflow vulnerability in Hirschmann Automation and Control HiOS and HiSecOS software.

Mitsubishi Electric MELSEC

Title

Mitsubishi Electric MELSEC

Published

March 31, 2020, 4:05 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-091-02

Summary

This advisory contains mitigations for an uncontrolled resource consumption vulnerability in Mitsubishi Electric MELSEC programmable controllers.

Schneider Electric Modicon Controllers (Update A)

Title

Schneider Electric Modicon Controllers (Update A)

Published

March 31, 2020, 4 p.m.

URL

https://www.us-cert.gov/ics/advisories/icsa-20-016-01

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-20-016-01 Schneider Electric Modicon Controllers that was published January 16, 2020, to the ICS webpage on us-cert.gov. This advisory contains mitigations for several improper check for unusual or exceptional conditions vulnerabilities in Schneider Electric Modicon PLC controllers.

24.03.2020