January 2024
23.01.2024
US CERT (ICS)
APsystems Energy Communication Unit (ECU-C) Power Control Software
Title
APsystems Energy Communication Unit (ECU-C) Power Control Software
Published
Jan. 23, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable via adjacent network / low attack complexity Vendor: APsystems Equipment: Energy communication Unit (ECU-C) Power Control Software Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access sensitive data and execute specific ...
23.01.2024
US CERT (ICS)
Lantronix XPort
Title
Lantronix XPort
Published
Jan. 23, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.7 ATTENTION: Low attack complexity Vendor: Lantronix Equipment: XPort Vulnerability: Weak Encoding for Password 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain credentials. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of XPort, a device server ...
23.01.2024
US CERT (ICS)
Crestron AM-300
Title
Crestron AM-300
Published
Jan. 23, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Low attack complexity Vendor: Crestron Equipment: AM-300 Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate their privileges to root-level access. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Crestron AirMedia Presentation ...
18.01.2024
US CERT (ICS)
AVEVA PI Server
Title
AVEVA PI Server
Published
Jan. 18, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Equipment: PI Server Vulnerabilities: Improper Check or Handling of Exceptional Conditions, Missing Release of Resource after Effective Lifetime 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to crash the product being ...
16.01.2024
US CERT (ICS)
Integration Objects OPC UA Server Toolkit
Title
Integration Objects OPC UA Server Toolkit
Published
Jan. 16, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-016-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Integration Objects Equipment: OPC UA Server Toolkit Vulnerability: Improper Output Neutralization for Logs 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to add content to the log file. 3. TECHNICAL DETAILS ...
16.01.2024
US CERT (ICS)
SEW-EURODRIVE MOVITOOLS MotionStudio
Title
SEW-EURODRIVE MOVITOOLS MotionStudio
Published
Jan. 16, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-016-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: SEW-EURODRIVE Equipment: MOVITOOLS MotionStudio Vulnerability: Improper Restriction of XML EXTERNAL Entity Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could result in open access to file information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions ...
11.01.2024
US CERT (ICS)
Rapid Software LLC Rapid SCADA
Title
Rapid Software LLC Rapid SCADA
Published
Jan. 11, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely, low attack complexity Vendor: Rapid Software LLC Equipment: Rapid SCADA Vulnerabilities: Path Traversal, Relative Path Traversal, Local Privilege Escalation through Incorrect Permission Assignment for Critical Resource, Open Redirect, Use of Hard-coded Credentials, Plaintext Storage of a Password, Generation of ...
11.01.2024
US CERT (ICS)
Schneider Electric Easergy Studio
Title
Schneider Electric Easergy Studio
Published
Jan. 11, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Easergy Studio Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full control of a workstation. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following ...
11.01.2024
US CERT (ICS)
Siemens SIMATIC
Title
Siemens SIMATIC
Published
Jan. 11, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-10
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
04.01.2024
US CERT (ICS)
Rockwell Automation FactoryTalk Activation
Title
Rockwell Automation FactoryTalk Activation
Published
Jan. 4, 2024, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-004-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Activation Manager Vulnerabilities: Out-of-Bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in a buffer overflow and allow the attacker to gain full access to the system. 3. TECHNICAL ...
December 2023
21.12.2023
US CERT (ICS)
FXC AE1021/AE1021PE
Title
FXC AE1021/AE1021PE
Published
Dec. 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: FXC Equipment: AE1021, AE1021PE Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution on the device via NTP server ...
21.12.2023
US CERT (ICS)
QNAP VioStor NVR
Title
QNAP VioStor NVR
Published
Dec. 21, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor: QNAP Equipment: VioStor NVR Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution by exploiting NTP settings. 3. TECHNICAL ...
19.12.2023
US CERT (ICS)
EFACEC UC 500E
Title
EFACEC UC 500E
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: EFACEC Equipment: UC 500 Vulnerabilities: Cleartext Transmission of Sensitive Information, Open Redirect, Exposure of Sensitive Information to an Unauthorized Actor, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to ...
19.12.2023
US CERT (ICS)
Subnet Solutions Inc. PowerSYSTEM Center
Title
Subnet Solutions Inc. PowerSYSTEM Center
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Subnet Solutions Inc. Equipment: PowerSYSTEM Center Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker achieving arbitrary code execution and privilege escalation through the unquoted service path. ...
19.12.2023
US CERT (ICS)
EuroTel ETL3100 Radio Transmitter
Title
EuroTel ETL3100 Radio Transmitter
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: EuroTel Equipment: ETL3100 Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Authorization Bypass Through User-Controlled Key, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain ...
19.12.2023
US CERT (ICS)
Open Design Alliance Drawing SDK
Title
Open Design Alliance Drawing SDK
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Open Design Alliance (ODA) Equipment: Drawing SDK Vulnerabilities: Use after Free, Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote attackers to disclose sensitive information on affected installations of ODA Drawing SDK. ...
19.12.2023
US CERT (ICS)
EFACEC BCU 500
Title
EFACEC BCU 500
Published
Dec. 19, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: EFACEC Equipment: BCU 500 Vulnerabilities: Uncontrolled Resource Consumption, Cross-site Request Forgery 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product or compromise the web ...
14.12.2023
US CERT (ICS)
Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC
Title
Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-06
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens RUGGEDCOM and SCALANCE M-800/S615 Family
Title
Siemens RUGGEDCOM and SCALANCE M-800/S615 Family
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-14
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens User Management Component (UMC)
Title
Siemens User Management Component (UMC)
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-03
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Title
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens Web Server of Industrial Products
Title
Siemens Web Server of Industrial Products
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-08
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Siemens SIMATIC and SIPLUS Products
Title
Siemens SIMATIC and SIPLUS Products
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-05
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...
14.12.2023
US CERT (ICS)
Johnson Controls Kantech Gen1 ioSmart
Title
Johnson Controls Kantech Gen1 ioSmart
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable from adjacent network Vendor: Sensormatic Electronics, LLC, an affiliate of Johnson Controls Inc. Equipment: Kantech Gen1 ioSmart card reader Vulnerability: Missing Release of Memory after Effective Lifetime 2. RISK EVALUATION An attacker with physical access to the Kantech Gen1 ioSmart ...
14.12.2023
US CERT (ICS)
Siemens SCALANCE and RUGGEDCOM M-800/S615 Family
Title
Siemens SCALANCE and RUGGEDCOM M-800/S615 Family
Published
Dec. 14, 2023, 1 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-13
Summary
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF 1. EXECUTIVE SUMMARY ...

Last Updates

BOSCH PSIRT
21.08.2024
SIEMENS CERT
12.09.2024
US CERT
19.09.2024
US CERT (ICS)
19.09.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds