Today CISA’s NCCIC-ICS published five control system security advisories for products from Rockwell Automation (2), Schneider Electric, New Rock Technologies, and Hitachi Energy. They also published a medical device security advisory and an update for products from Contec Health. They also published a control system update for products from Mitsubishi.
Rockwell Advisory #1
This advisory describes three vulnerabilities in the Rockwell FactoryTalk AssetCentre. The vulnerabilities were reported by Nestlé - Alban Avdiji. Rockwell has a new version that mitigates the vulnerability.
The three reported vulnerabilities are:
Inadequate encryption strength - CVE-2025-0477, and
Insufficiently protected credentials (2) - CVE-2025-0497 and CVE-2025-0498
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to extract passwords, access, credentials, or impersonate other users.
Rockwell Advisory #2
This advisory discusses an uncontrolled resource consumption vulnerability in the Rockwell KEPServerEX. This is a third-party (PTC) vulnerability. Rockwell has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause the device to crash.
Schneider Advisory
This advisory describes an exposure of sensitive information to an unauthorized actor vulnerability in the Schneider Harmony Industrial PC and Pro-face Industrial PC. The vulnerability was self-reported. Schneider provides instructions for removing the affected application.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to access sensitive information.
NOTE: I briefly discussed the vulnerability on October 12th, 2024.
New Rock Advisory
This advisory describes two vulnerabilities in the New Rock Cloud Connected Devices. The vulnerability was reported to CISA by Tomer Goldschmidt of Claroty Team82. CISA reports that “New Rock Technologies has not responded to requests to work with CISA to mitigate these vulnerabilities.”
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker full control of the device.
Hitachi Energy Advisory
This advisory describes eight vulnerabilities in the Hitachi Energy UNEM product. The vulnerability was self-reported. Hitachi Energy has new versions that mitigate the vulnerability (with one affected product being reported as EOL).
The eight reported vulnerabilities are:
Authentication bypass using alternate path or channel - CVE-2024-2013,
Argument injection - CVE-2024-2012,
Heap-based buffer overflow - CVE-2024-2011,
Incorrect user management - CVE-2024-28020,
Improper certificate validation - CVE-2024-28021,
Improper restriction of excessive authentication requests - CVE-2024-28022
Use of hard-coded password - CVE-2024-28023
Cleartext storage of sensitive information - CVE-2024-28024
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to cause a denial of service, execute unintended commands, access sensitive information, or execute arbitrary code.
NOTE: I briefly discussed these vulnerabilities on June 15th, 2024.
Contec Advisory
This advisory describes three vulnerabilities in the Contec CMS8000 Patient Monitor. The vulnerability was reported to CISA by an anonymous researcher. CISA recommends that users remove any Contec CMS8000 devices from their networks. The FDA recommends that remote monitoring functions be disabled; if the associated wireless capabilities cannot be disabled, the FDA recommends unplugging the device and stop using it.
The three reported vulnerabilities are:
Out-of-bounds write - CVE-2024-12248,
Backdoor - CVE-2025-0626, and
Exposure of private personal information to an unauthorized actor - CVE-2025-0683
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to remotely send specially formatted UDP requests or connect to an unknown external network that would allow them to write arbitrary data, resulting in remote code execution. The device may also leak patient information and sensor data to the same unknown external network. Simultaneous exploitation of all vulnerable devices on a shared network is possible.
NOTE: CISA published a stand-alone fact sheet on the backdoor vulnerability described in this advisory. The FDA published a Safety Communication about the reported vulnerabilities.
Contec Update
This update provides additional information on the CMS8000 Patient Monitor advisory that was originally published on September 1st, 2022. The new information includes:
Updating Risk Evaluation section vulnerabilities,
Adding in CVSS 4.0 scores,
Updating discouraged CWEs, aligned title and mitigation recommendations with ICSMA-25-030-01.
Mitsubishi Update
This update provides additional information on the FA Engineering Software Products advisory that was originally published on May 14th, 2024, and most recently updated on October 31st, 2024. The new information includes adding version information to affected product and mitigation sections.
DTRH Look at Kepware Vulnerability
The Rockwell advisory for today’s Kepware advisory from CISA was one of the three ‘other advisories’ that I briefly mentioned on Tuesday. Rockwell reported that:
“Rockwell Automation received a report from PTC, a strategic partner of Rockwell Automation, regarding this vulnerability discovered by Security Researchers of Claroty Team82 during the Pwn2Own competition hosted by Trend Micro’s Zero Day Initiative (ZDI). Rockwell Automation used the latest version of the CVSS scoring system to assess the following vulnerabilities.”
A quick check of the CVE number (CVE-2023-3825) reported in today’s advisory traces back to a CISA advisory (ICSA-23-208-02) that was published on July 27th, 2023, for the PTC KEPServerEX with the same version numbers that are being reported today. In the ‘Mitigations’ section of that 2023 advisory, CISA provides a link to the PTC advisory for the vulnerability, which was published on July 26th, 2023.
It is interesting to see that it took almost a year and a half from the PTC advisory to the publication of Rockwell’s advisory, especially since ZDI published the fact that Claroty demonstrated a DOS attack based upon this vulnerability at the 2023 Miami Pwn-to-Own competition in the PTC KEPServerEX.