us-cert

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).  View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Low attack complexity Vendor: Siemens Equipment: SIMATIC PCS 7, SIMATIC WinCC Vulnerability: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local attacker to cause a denial-of-service condition in the runtime of the SCADA system. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Siemens SIMATIC PCS 7 and SIMATIC WinCC, a SCADA system, are affected: Siemens SIMATIC PCS 7 V9.1: All versions before V9.1 SP2 UC04 Siemens SIMATIC WinCC Runtime Professional V17: All versions Siemens SIMATIC WinCC Runtime Professional V18: All versions Siemens SIMATIC WinC...

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).  View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Scalance W1750D Vulnerabilities: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to exploit buffer overflow and information disclosure vulnerabilities which could lead to information disclosure or unauthenticated remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following products of Siemens Scalance W1750D, a direct access point, are affected: Siemens SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0): All versions prior to V8.10.0.9 Siemens SCALANCE W1750D (ROW) (6GK5750-2HX...

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).  View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: RUGGEDCOM APE1808 Vulnerabilities: Network Amplification, Exposure of Sensitive System Information to an Unauthorized Control Sphere, External Control of File Name or Path, Cross-site Scripting, Insufficiently Protected Credentials, Externally Controlled Reference to a Resource in Another Sphere 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Siemens RUGGEDCO...

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.6 ATTENTION: Low attack complexity Vendor: SUBNET Solutions Inc. Equipment: PowerSYSTEM Server, Substation Server 2021 Vulnerabilities: Reliance on Insufficiently Trustworthy Component 2. RISK EVALUATION Successful exploitation of the vulnerabilities in components used by PowerSYSTEM Server 2021 and Substation Server 2021 could allow privilege escalation, denial of service, or arbitrary code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS SUBNET Solutions reports that the following products use components with vulnerabilities: PowerSYSTEM Server: version 4.07.00 and prior Substation Server 2021: version 4.07.00 and prior 3.2 Vulnerability Overview 3.2.1 RELIANCE ON INSUFFICIENTLY TRUSTWORTHY COMPONENT CWE-1357 SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021. CVE-2024-3313 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.4 has been ...

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Asset Suite 9 Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to use an authentication anomaly to successfully invoke the REST service. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Hitachi Energy's Asset Suite, an enterprise asset management tool, are affected: Asset Suite: Versions prior to 9.6.3.13 Asset Suite: Versions prior to 9.6.4.1 3.2 Vulnerability Overview 3.2.1 IMPROPER AUTHENTICATION CWE-287 REST service authentication anomaly with "valid username/no password" credential combination for batch job processing may result in successful service invocation. The anomaly doesn't exist with other credential combinations. CVE-2024-2244 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is (A...

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schweitzer Engineering Laboratories Equipment: SEL 700 series relays Vulnerability: Inclusion of Undocumented Features 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to make modifications or cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Schweitzer Engineering Laboratories products are affected: SEL-700BT Motor Bus Transfer Relay: R301-V0 up to but not including R301-V6 SEL-700BT Motor Bus Transfer Relay: R302-V0 up to but not including R302-V1 SEL-700G Generator Protection Relay: R100-V0 up to but not including R301-V6 SEL-700G Generator Protection Relay: R302-V0 up to but not including R302-V1 SEL-710-5 Motor Protection Relay: R100-V0 up to but not including R302-V1 SEL-751 Feeder Protection Relay: R101-V0 up to but not including R302-V3 SEL-751 Feeder Protection Relay: R400-V0 up to but not i...

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.4 ATTENTION: Exploitable from adjacent network/Low attack complexity Vendor: IOSiX Equipment: IO-1020 Micro ELD Vulnerabilities: Use of Default Credentials, Download of Code Without Integrity Check 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an adjacent attacker to take control of vehicle systems by connecting to and modifying the affected device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following IOSiX products are affected: IO-1020 Micro ELD: Versions prior to 360 3.2 Vulnerability Overview 3.2.1 USE OF DEFAULT CREDENTIALS CWE-1392 IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device. CVE-2024-30210 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.4 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). A CVSS v4 score has also been calculated for CVE-2024-30210. A base score of 8.5 has been calc...

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: AutomationDirect Equipment: C-MORE EA9 HMI Vulnerabilities: Path Traversal, Stack-Based Buffer Overflow, Plaintext Storage of a Password 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to exploit a remote device and inject malicious code on the panel. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of C-MORE EA9 HMI, a display system used for interfacing with controllers, are affected: C-MORE EA9 HMI EA9-T6CL: Version 6.77 and prior C-MORE EA9 HMI EA9-T7CL: Version 6.77 and prior C-MORE EA9 HMI EA0-T7CL-R: Version 6.77 and prior C-MORE EA9 HMI EA9-T8CL: Version 6.77 and prior C-MORE EA9 HMI EA9-T10CL: Version 6.77 and prior C-MORE EA9 HMI EA9-T10WCL: Version 6.77 and prior C-MORE EA9 HMI EA9-T12CL: Version 6.77 and prior C-MORE EA9 HMI EA9-T15CL: Version 6.77 and prior C-MORE EA9 HMI EA9-T15CL-R: Version 6.77 and prior C-...

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk View ME Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to the loss of view or control of the PanelView product. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of FactoryTalk View ME, an HMI software application, are affected: FactoryTalk View ME: prior to v14 3.2 Vulnerability Overview 3.2.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 A vulnerability exists in the affected product that allows a malicious user to restart the PanelView Plus 7 terminal remotely without security protections. If the vulnerability is exploited, it could lead to the loss of view or control of the PanelView product. CVE-2024-21914 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vecto...

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: PowerFlex 527 Vulnerabilities: Improper Input Validation, Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this these vulnerabilities could crash the device and require a manual restart to recover. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Rockwell Automation reports that the following versions of PowerFlex 527 adjustable frequency AC drives are affected: PowerFlex 527: Versions v2.001.x and later 3.2 Vulnerability Overview 3.2.1 Improper Input Validation CWE-120 A denial-of-service vulnerability exists in the PowerFlex 527 due to improper input validation in the device. If exploited, the web server will crash and need a manual restart to recover it. CVE-2024-2425 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A ...