For Part 2 we have 7 vendor disclosures from Schneider Electric. There are also seven updates from Schneider and Siemens (6).
Schneider Advisories
Schneider published an advisory describing two vulnerabilities in their Modicon M340 controller and
Communication Modules. Schneider provides generic mitigation measures as the final action on this advisory.
The two reported vulnerabilities are:
Uncontrolled resource consumption - CVE-2022-22724, and
Cross-site request forgery - CVE-2020-7534
NOTE: The CSRF vulnerability was previously reported in M340 CPU’s by Schneider.
Schneider published an advisory describing a buffer copy without checking size of input vulnerability in their Easergy T300 RTU. This is a third-party (pppd) vulnerability. Schneider has a new firmware version that mitigates the vulnerability.
Schneider published an advisory describing two vulnerabilities in their Easergy P5 product line. The vulnerabilities were reported by Timothée Chauvin, Paul Noalhyt, Yuanshe Wu at Red Balloon
Security. Schneider has a new firmware version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Use of hard-coded credentials - CVE-2022-22722, and
Buffer copy without checking size of input - CVE-2022-22723
Schneider published an advisory describing a buffer copy without checking size of input vulnerability in their Easergy P3 products. The vulnerability was reported by Timothée Chauvin, Paul Noalhyt, Yuanshe Wu at Red Balloon Security. Schneider has a new firmware version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
Schneider published an advisory describing six vulnerabilities in their ConneXium Tofino Firewall products. These are 3rd party (LG) vulnerabilities. Schneider has new versions that mitigate the vulnerabilities.
The six reported vulnerabilities are:
USB vulnerability - CVE-2021-30061, CVE-2021-30066,
OPC vulnerability - CVE-2021-30062, CVE-2021-30063,
Hard-coded credentials - CVE-2021-30064, and
Modbus vulnerability - CVE-2021-30065
NOTE: These are the same vulnerabilities reported this week by Belden (See Part 1). The CVE’s point back to https://lgsecurity.lge.com/, but I cannot find any advisories for these vulnerabilities on that site.
Schneider published an advisory discussing 10 vulnerabilities in various Schneider products based upon CODESYS products. Schneider is providing generic mitigation measures pending development of fixes.
The ten reported vulnerabilities are:
Out-of-bounds write - CVE-2021-33485,
NULL pointer dereference - CVE-2021-29241,
Improper package validation - CVE-2021-29240,
Deserialization of untrusted data (7) - CVE-2021-21863, CVE-2021-21864 (exploit), CVE-2021-21865, CVE-2021-21866 (exploit), CVE-2021-21867 (exploit), CVE-2021-21868 (exploit), CVE-2021-21869 (exploit)
Schneider published an advisory describing four vulnerabilities in their EcoStruxure™ Power Monitoring Expert product. The vulnerabilities were reported by Robert Erbes of DOE CyTRICS. Schneider has new versions that mitigate the vulnerabilities. There is no indication that Erbes has been provided an opportunity to verify the efficacy of the fix.
The four reported vulnerabilities are:
Improper input validation (2) - CVE-2022-22726 and CVE-2022-22727,
Denial of Service (3rd party – Flexera) - CVE-2019-8963, and
Cross-site scripting - CVE-2022-22804
Schneider Update
Schneider published an update for their BadAlloc advisory that was originally published on November 9th, 2021 and most recently updated on December 15th, 2021. The new information includes:
Adding fixes for Easergy P5, EPC3000, Harmony/ Magelis HMIGTU Series, HMIGTUX Series, HMIGK Series, nanodac, Pro-face SP5B00, SP-5B10,SP-5B90,ST6000 Series (GPProEX model), ET6000 Series, and
Updating affected versions to all versions for Proface GP4000 Series, LT4000M Series, GP4000H Series
Siemens Updates
Siemens published an update for their NAME:WRECK advisory that was originally published on April 13th, 2021 and most recently updated on November 9th, 2021. The new information includes removing CAPITAL VSTAR from the list of affected products.
NOTE: NCCIC-ICS did not update their advisory (ICSA-21-103-04) to reflect this change.
Siemens published an update for their WIBU CodeMeter advisory that was originally published on November 9th, 2021 an most recently updated on December 14th, 2021. The new information includes adding fixes for SIMATIC PCS neo, Information Server Process Historian.
Siemens published an update for their NAME:WRECK advisory that was originally published on April 13th, 2021 and most recently updated on November 9th, 2021. The new information includes removing CAPITAL VSTAR from the list of affected products. The new information includes adding a fix for SIMATIC Process Historian 2020.
NOTE: NCCIC-ICS did not update their advisory (ICSA-21-287-09) to reflect this change.
Siemens published an update for their SIMATIC Process Historian advisory that was originally published on October 14th, 2021.
Siemens published an update for their OpenSSL advisory that was originally reported on July 13th, 2021 and most recently updated on December 14th, 2021. The new information includes:
Adding fixes for SIMATIC HMI Panels, SIMATIC Logon and SIMATIC PDM, and
Clarified that no remediation is planned for SCALANCE W-700 IEEE 802.11n family
Siemens published an update for their INFRA:HALT advisory that was originally published on August 4th, 2021 and most recently updated on September 14th, 2021. The new information includes adding fix for r SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module (7KM9300-0AE01-0AA0)