Today, CISA’s NCCIC-ICS updated one control system security advisories for products from Mitsubishi and a medical device security advisory for products from Fresenius Kabi .
Mitsubishi Update
This update provides additional information on an advisory that was originally published on November 30th, 2021. The new information includes updating affected version information and providing mitigation measures for:
MELSEC Q Series Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU, and
MELSEC L Series L02/06/26CPU(-P), L26CPU-(P)BT
NOTE: NCCIC-ICS also made a correction to the nomenclature for Q172/173DSCPU which was also corrected by Mitsubishi in their advisory. It was originally published as “Q172/172DSCPU”. This change was not marked on the NCCIC-ICS advisory.
Fresenius Update
This update provides additional information on an advisory that was originally published on December 21st, 2021. The new information includes adding the following statement to the ‘Risk Evaluation’ section of the advisory:
“According to Fresenius Kabi, the Agilia infusion pump alarm is not impacted by the vulnerabilities described in this advisory. Fresenius Kabi maintains the infusion parameters are preserved, current infusion is not interrupted, and no unacceptable patient risk is identified. Fresenius Kabi also maintains there is no risk of exposure of personally identifiable information (PII) or protected health information (PHI).”
NOTE: While NCCIC-ICS did publish this information from Fresenius Kabi, they did not repudiate the advisory nor did they make any other changes to the advisory. Even the description of the risk that immediately proceeds the new statement remains unchanged. It will be interesting to see if BSI publishes a new ManiMed report that addresses these reported vulnerabilities. But remember, NCCIC-ICS does not actually evaluate these reports or the disagreements between researchers or vendors.