Bulletins | CERT@VDE

INVT Electric VT-Designer

Title

INVT Electric VT-Designer

Published

Nov. 29, 2018, 6 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-331-01-0

Summary

This advisory includes mitigations for deserialization of untrusted data and heap-based buffer overflow vulnerabilities in INVT Electric's VT-Designer.

27.11.2018

AVEVA Vijeo Citect and Citect SCADA

Title

AVEVA Vijeo Citect and Citect SCADA

Published

Nov. 27, 2018, 4 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-331-01

Summary

This advisory includes mitigations for an uncontrolled search path element vulnerability in Schneider Electric's Software Update utility affecting AVEVA's Vijeo Citect and Citect SCADA products.

20.11.2018

Teledyne DALSA Sherlock

Title

Teledyne DALSA Sherlock

Published

Nov. 20, 2018, 4:05 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-324-01

Summary

This advisory includes mitigations for a stack-based buffer overflow vulnerability in Teledyne DALSA's Sherlock machine vision software interface.

Siemens IEC 61850 System Configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC

Title

Siemens IEC 61850 System Configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC

Published

Nov. 13, 2018, 4:35 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-01

Summary

This advisory includes mitigations for an improper access control vulnerability in the Siemens IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC products.

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-02

Siemens S7-400 CPUs

Title

Siemens S7-400 CPUs

Published

Nov. 13, 2018, 4:30 p.m.

URL

Summary

This advisory includes mitigations for improper input validation vulnerabilities in the Siemens S7-400 CPUs.

Siemens SIMATIC Panels and SIMATIC WinCC (TIA Portal)

Title

Siemens SIMATIC Panels and SIMATIC WinCC (TIA Portal)

Published

Nov. 13, 2018, 4:25 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-03

Summary

This advisory includes mitigations for a code injection vulnerability in the Siemens SIMATIC Panels software and SIMATIC WinCC (TIA Portal).

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-04

Siemens SCALANCE S

Title

Siemens SCALANCE S

Published

Nov. 13, 2018, 4:20 p.m.

URL

Summary

This advisory includes mitigations for a cross-site scripting vulnerability in Siemens' SCALANCE S security appliance.

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-05

Siemens SIMATIC S7

Title

Siemens SIMATIC S7

Published

Nov. 13, 2018, 4:15 p.m.

URL

Summary

This advisory includes mitigations for a resource exhaustion vulnerability in Siemens' Simatic S7 controllers.

Siemens SIMATIC STEP 7 (TIA Portal)

Title

Siemens SIMATIC STEP 7 (TIA Portal)

Published

Nov. 13, 2018, 4:10 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-06

Summary

This advisory includes mitigations for an unprotected storage of credentials vulnerability in Siemens' SIMATIC STEP 7 engineering software.

Siemens SIMATIC IT Production Suite

Title

Siemens SIMATIC IT Production Suite

Published

Nov. 13, 2018, 4:05 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-07

Summary

This advisory includes mitigations for an improper authentication vulnerability in Siemens' SIMATIC IT Production Suite software.

Siemens SIMATIC Panels

Title

Siemens SIMATIC Panels

Published

Nov. 13, 2018, 4 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-08

Summary

This advisory includes mitigations for path traversal and open redirect vulnerabilities in Siemens' SIMATIC panels.

08.11.2018

Philips iSite and IntelliSpace PACS

Title

Philips iSite and IntelliSpace PACS

Published

Nov. 8, 2018, 3:31 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSMA-18-312-01

Summary

This medical device advisory includes mitigations for a weak password Requirements vulnerability in the Philips iSite and IntelliSpace PACS.

06.11.2018

Roche Point of Care Handheld Medical Devices

Title

Roche Point of Care Handheld Medical Devices

Published

Nov. 6, 2018, 5:08 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01

Summary

This medical device advisory includes mitigations for improper authentication, OS command injection, unrestricted upload of file with dangerous type, and improper access control vulnerabilities in Roche's Point of Care handheld medical devices.

06.11.2018

Roche Diagnostics Point of Care Handheld Medical Devices (Update A)

Title

Roche Diagnostics Point of Care Handheld Medical Devices (Update A)

Published

Nov. 6, 2018, 5:08 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01

Summary

This updated medical device advisory is a follow-up to the original advisory titled ICSMA-18-310-01 Roche Point of Care Handheld Medical Devices that was published November 6, 2018 on the NCCIC/ICS-CERT website. This updated medical device advisory includes mitigations for improper authentication, OS command injection, unrestricted upload of file with dangerous ...

AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)

Title

AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)

Published

Nov. 1, 2018, 3:15 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01

Summary

This advisory includes mitigations for stack-based buffer overflow and empty password in configuration file vulnerabilities in AVEVA’s InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition) products.

Schneider Electric Software Update (SESU) (Update A)

Title

Schneider Electric Software Update (SESU) (Update A)

Published

Nov. 1, 2018, 3:10 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-02

Summary

This updated advisory is a follow-up to the original advisory titled ICSA-18-305-02 Schneider Electric Software Update that was published November 1, 2018, on the NCCIC/ICS-CERT website. This updated advisory includes mitigations for a DLL hijacking vulnerability in the Schneider Electric Software Update (SESU).

Schneider Electric Software Update (SESU)

Title

Schneider Electric Software Update (SESU)

Published

Nov. 1, 2018, 3:10 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-02

Summary

This advisory includes mitigations for a DLL hijacking vulnerability in the Schneider Electric Software Update (SESU).

Circontrol CirCarLife

Title

Circontrol CirCarLife

Published

Nov. 1, 2018, 3:05 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-03

Summary

This advisory includes mitigations for authentication bypass using an alternate path or channel and insufficiently protected credentials vulnerabilities in Circontrol’s CirCarLife, an electric vehicle charging station.

Fr. Sauter AG CASE Suite

Title

Fr. Sauter AG CASE Suite

Published

Nov. 1, 2018, 3 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-04

Summary

This advisory includes mitigations for an improper restriction of XML External Entity Reference vulnerability in Fr. Sauter AG's CASE Suite software.

October 2018

30.10.2018

PEPPERL+FUCHS CT50-Ex

Title

PEPPERL+FUCHS CT50-Ex

Published

Oct. 30, 2018, 5:23 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-303-01

Summary

This advisory includes mitigations for an improper privilege management vulnerability in the PEPPERL+FUCHS CT50-Ex ecom mobile computer.

25.10.2018

GEOVAP Reliance 4 SCADA/HMI

Title

GEOVAP Reliance 4 SCADA/HMI

Published

Oct. 25, 2018, 4:05 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-298-01

Summary

This advisory includes mitigations for a cross-site scripting vulnerability in GEOVAP's Reliance 4 SCADA/HMI system.

23.10.2018

GAIN Electronic Co. Ltd SAGA1-L Series

Title

GAIN Electronic Co. Ltd SAGA1-L Series

Published

Oct. 23, 2018, 4:05 p.m.

URL

https://ics-cert.us-cert.gov/advisories/ICSA-18-296-02

Summary

This advisory includes mitigations for authentication bypass by capture-relay, improper access control, and improper authentication vulnerabilities in GAIN Electronic's SAGA1-L series transmitters.

23.10.2018

https://ics-cert.us-cert.gov/advisories/ICSA-18-296-03

Telecrane F25 Series

Title

Telecrane F25 Series

Published

Oct. 23, 2018, 4 p.m.

URL

Summary

This advisory includes mitigations for an authentication bypass by capture-replay vulnerability in the Telecrane F25 Series software.

17.10.2018

https://ics-cert.us-cert.gov/advisories/ICSA-18-290-01

OMRON CX-Supervisor

Title

OMRON CX-Supervisor

Published

Oct. 17, 2018, 2:55 p.m.

URL

Summary

This advisory includes mitigations for improper restriction of operations within the bounds of a memory buffer, out-of-bounds read, use-after-free, and incorrect type conversion or cast vulnerabilities in OMRON's CX-Supervisor software.

11.10.2018