This week, as we have come to expect for the Saturday after 2nd Tuesday, we have a full slate of ICS disclosures, including more Log4Shell disclosures, that will take multiple posts to deal with. In Part 1 we have fourteen vendor disclosures from Belden, Blackberry, Dynalite, Hitachi Energy, HPE, Moxa, Palo Alto Networks (4), QNAP (3), and Yokogawa. There is also an update from HPE. There were also two researcher reports for products from IDEMIA and ODA. Finally, we have an exploit for products from SonicWall.
Part 2 of this post will address the Schneider advisories and updates that were published on Tuesday as well as the Siemens updates that were not addressed by NCCIC-ICS this week.
Belden Advisory
Belden published an advisory describing six vulnerabilities in their Tofino and Eagle products. The vulnerabilities were reported by Jacob Baines of Dragos. Belden has new versions for some of the affected products that mitigates the vulnerabilities. There is no indication that Baines has been provided an opportunity to verify the efficacy of the fix.
The six reported vulnerabilities are:
USB vulnerability - CVE-2021-30061, CVE-2021-30066,
OPC vulnerability - CVE-2021-30062, CVE-2021-30063,
Hard-coded credentials - CVE-2021-30064, and
Modbus vulnerability - CVE-2021-30065
BlackBerry Advisory
BlackBerry published an advisory describing an elevation of privilege vulnerability in their QNX Neutrino Kernel. The vulnerability was reported by Minrui Yan and Yingjie Cao of Sky-Go Team. BlackBerry has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
Dynalite Advisory
Dynalite published an advisory discussing two vulnerabilities in their DDNG-BACnet gateway and in Niagara SOFTJACE products. These are third-party (Tridium Niagara) vulnerabilities. Dynalite recommend updating the Tridium Niagara platform.
The two reported vulnerabilities are:
Improper authentication - CVE-2017-16748, and
Path Traversal - CVE-2017-16744
Hitachi Energy Advisory
Hitachi Energy published an advisory discussing four vulnerabilities in their e-mesh™ Energy Management System (EMS) Product. These are third-party (Node-JS) vulnerabilities. Hitachi Energy has a new version that mitigates the vulnerabilities.
The four reported vulnerabilities are:
Integer underflow - CVE-2020-8174 (exploit),
Use after free - CVE-2020-8265 (exploit), and
Uncontrolled resource consumption - CVE-2020-11080 and CVE-2021-22883 (exploit)
HPE Advisory
HPE published an advisory describing a remote access vulnerability in their Ezmeral Data Fabric. HPE has a new version that mitigates the vulnerability.
Moxa Advisory
Moxa published an advisory describing four vulnerabilities in their VPort 06EC-2V Series and VPort 461A Series IP Cameras and Video Servers. The vulnerabilities were reported by Qian Chen from the Codesafe Team of Legendsec. Moxa has new versions that mitigate the vulnerabilities. There is no indication that Qian has been provided an opportunity to verify the efficacy of the fix.
The four reported vulnerabilities are:
NULL pointer dereference,
Integer underflow,
Out-of-bounds read, and
Memory leak
Palo Alto Advisories
Palo Alto published an advisory describing an uncontrolled search path element vulnerability in their Cortex XDR Agent. The vulnerability was reported by Xavier Danest of Decathlon. Palo Alto has new versions that mitigates the vulnerability. There is no indication that Danest has been provided an opportunity to verify the efficacy of the fix.
Palo Alto published an advisory describing an untrusted search path element vulnerability in their Cortex XDR Agent. Palo Alto has new versions that mitigates the vulnerability.
Palo Alto published an advisory describing a link following vulnerability in their Cortex XDR Agent. The vulnerability was reported by Chris Au. Palo Alto has new versions that mitigates the vulnerability. There is no indication that Au has been provided an opportunity to verify the efficacy of the fix.
Palo Alto published an advisory describing a file and directory information exposure vulnerability in their Cortex XDR Agent. Palo Alto has new versions that mitigate the vulnerability.
Phoenix Contact Advisory
Phoenix Contact published an advisory discussing the NUCLEUS:13 vulnerabilities in their BLUEMARK X1 / LED / CLED printers. Phoenix Contact provides generic work arounds.
QNAP Advisories
QNAP published an advisory describing a remote code execution vulnerability in their QTS and QuTS hero products. QNAP has a new version that mitigates the vulnerability.
QNAP published an advisory describing five separate classic buffer overflow vulnerabilities in their QVR Elite, QVR Pro, and QVR Guard products. The vulnerabilities were reported by crixer. QNAP has new versions that mitigate the vulnerabilities. There is no indication that crixer has been provided an opportunity to verify the efficacy of the fix.
QNAP published an advisor describing two vulnerabilities in their QcalAgent. The vulnerabilities were reported by Tony Martin. QNAP has a new version that mitigates the vulnerabilities. There is no indication that Martin has been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Cross-site scripting - CVE-2021-38677, and
Open redirect - CVE-2021-38678
Yokogawa Advisor
Yokogawa published an advisory discussing a link following vulnerability in the license function in Yokogawa products. This is a third-party (Thales) vulnerability. Yokogawa has new versions that mitigate the vulnerability.
HPE Update
HPE published an update for their Integrated Lights-out 4 advisory that was originally published on August 23rd, 2017. The new information includes adding the NonStop impacted products.
IDEMIA Report
Positive Technologies published a report of a TLS bypass vulnerability in biometric identification vulnerabilities in products from IDEMIA. IDEMIA reports that it has a new version that mitigates the vulnerability.
ODA Report
ZDI published a report describing a JPG File Parsing Memory Corruption in the Open Design Alliance (ODA) Drawings Explorer. The vulnerability was reported by Matt Powell. ODA reports that it has a new version that mitigates the vulnerability.
SonicWall Exploit
jbaines-r7 published Metasploit module for a command injection vulnerability in the SonicWall SMA 100 Series. There is no CVE listed nor is there any report of coordinated disclosure so this may be a 0-day exploit.