Today, CISA’s NCCIC-ICS published a control system security advisory for products from Johnson Controls.
Johnson Controls Advisory
This advisory describes an improper handling of syntactically invalid structure vulnerability in the Johnson Controls (American Dynamics) VideoEdge network video recorder. The vulnerability was self-reported. Johnson Controls has a new version that mitigates the vulnerability and has hot fixes available for some of the affected versions.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability (by running a vulnerability scanner) to cause some functions to stop.
NOTE: I briefly described this vulnerability on December 25th, 2021. Johnson Controls updated their advisory to add the NCCIC-ICS advisory number and link.
Log4Shell Update
While on the Johnson Controls advisory page looking at the original notice for today’s NCCIC-ICS advisory, I noticed that they had updated their Log4Shell advisory for the 15th time yesterday. A quick look at the page shows that all of the listed products on the advisory are now listed as either ‘Not Impacted’ or ‘Remediated’. There are a number of products on the list that show results for specific versions instead of the more common “All Supported Versions”, which may indicate that further analysis needs to be conducted.
2nd Tuesday Advisories
For the third month in a row, NCCIC-ICS has not addressed any of the 2nd Tuesday advisories that were published by Siemens and Schneider today. Some will probably be addressed on Thursday. I will report on the remaining advisories and updates this weekend.