Today, CISA’s NCCIC-ICS published a control system security advisory for products from Mitsubishi Electric. They also updated an advisory for products from Philips. I also take a look at problems with the CISA web pages today.
Mitsubishi Advisory
This advisory discusses two vulnerabilities in the Mitsubishi MELSOFT iQ AppPortal. These are third-party (Apache) vulnerabilities. Mitsubishi has a new version that mitigates the vulnerabilities.
The two reported vulnerabilities are:
HTTP request/response smuggling - CVE-2022-26377, and
Insufficient verification of data authenticity - CVE-2022-31813
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow a malicious attacker to make unidentified impacts such as authentication bypass, information disclosure, denial-of-service, or bypass IP address authentication.
Philips Update
This update provides new information for an advisory that was originally published on July 6th, 2021 and most recently updated on January 20th, 2022. The new information includes adding a partial fixes for VuePAC (WFM), Vue Motion (Enterprise Viewer), Vue Explorer, and Web System Configuration.
CISA Web Site Problems
Today while preparing this post, I ran into a temporary problem on the CISA web site. When I initially tried to access the both the ICS Advisories and the NCAS Current Activity web pages, both returned a ‘Page Not Found’ advisory. Trying to access the advisories from the links from the CISA email announcing today’s advisories returned the same advisory. Checking back on previously issued advisories similarly returned ‘Page Not Found’ result.
This was a short term problem. Based upon a tweet by Stefan Woronka, they were almost certainly available at about 12:45 EDT. I played around searching for them for about a half-hour when I tweeted about the problem at 1:52 EDT and them becoming available at 2:18 EDT. Problems happen from time to time with large web sites…
I did find one odd thing during my search for the ‘missing’ advisories. One of the places I looked was the CISA.gov Sitemap. As you would expect, that is a very big map. But as large as it is, I cannot find a listing for ‘USCERT’ where the ICS Advisories or the Current Activity pages would be listed, nor do I find any listing for National Cybersecurity and Communications Integration Center (NCCIC). Now these site maps are not really an official document and they are hard to maintain with very large systems like CISA’s.