mySCADA Advisory
This advisory describes a command injection vulnerability in the mySCADA myPRO HMI /SCADA products. The vulnerability was reported by Michael Heinzl. mySCADA has a new version that mitigates the vulnerability. There is no indication that Heinzl has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow arbitrary operating system commands injection.
Yokogawa Advisory
This advisory describes ten vulnerabilities in the Yokogawa CENTUM and Exaopc products. The vulnerabilities were reported by Jacob Baines from Dragos. Yokogawa has new versions that mitigate the vulnerabilities. There is no indication that Baines was provided an opportunity to verify the efficacy of the fix.
The ten reported vulnerabilities are:
Use of hard-coded credentials (2) - CVE-2022-21194 and CVE-2022-23402,
Relative path traversal (2) - CVE-2022-21808 and CVE-2022-22729,
Improper output neutralization for logs (3) - CVE-2022-22151, CVE-2022-21177. and CVE-2022-22145,
OS command injection - CVE-2022-22148,
Permissions, privileges and access control - CVE-2022-22141,
Uncontrolled search path element - CVE-2022-23401
NCCIC-ICS reported that a relatively low-skilled attacker could remotely exploit these vulnerabilities in CAMS server functions can be abused to suppress alarms, read or write files, crash the server, or execute arbitrary code.
NOTE: This advisory is based upon an advisory that was originally published by Yokogawa on January 7th, 2022 and subsequently updated on February 9th, 2022. That update added the multiple CVE’s for the single path traversal and output neutralization vulnerabilities listed in the original advisory.