Public ICS Disclosure – Week of 4-1-23

This week we have six vendor disclosures from ABB, Belden, GE Gas Power, Palo Alto Networks, Ruckus Wireless, and Yokogawa. We also have four vendor updates for products from Aruba Networks and CODESYS (3). Finally, we have three vendor reports for vulnerabilities in AMD products.

ABB Advisory

ABB published an advisory that describes an insecure storage of sensitive information in their My Control System (on-premise). ABB has a new version that mitigates the vulnerability.

Belden Advisory

Belden published an advisory that describes a privilege escalation vulnerability in their Hirschmann Industrial HiVision product. Belden has a new version that mitigates the vulnerability.

GE Advisory

GE Gas Power published an advisory that discusses a path traversal vulnerability in multiple products. This is a third-party (Fortinet) vulnerability. GE is validating the Fortinet firmware update and will be providing updates for their affected products.

Palo Alto Networks Advisory

Palo Alto Networks published an advisory that discusses the DLL side loading vulnerability utilized by the Rorschach ransomware. Palo Alto Networks reports that older versions of their Cortex XDR product may be affected by this vulnerability. Palo Alto Networks has new versions that mitigate the vulnerability.

Ruckus Advisory

Ruckus published an advisory that discusses the  Framing Frames vulnerability. Ruckus provides a list of affected products and provides generic mitigation measures pending development of a fix.

Yokogawa Advisory

Yokogawa published an advisory that describes an elevation of privilege vulnerability in their CENTUM Authentication Mode. Yokogawa has new versions that mitigate the vulnerability.

Aruba Update

Aruba published an update for their Framing Frames advisory that was originally published on March 30^th, 2023. The new information includes listing firmware updates that mitigate the vulnerability.

CODESYS Updates

CODESYS published an update that provides additional information for their runtime system V3 communication server advisory that was originally published on February 23^rd, 2023 and most recently updated on March 8^th, 2023. The new information includes additional fixes.

CODESYS published an update that provides additional information for their Control V3 advisory that was originally published on February 23^rd, 2023 and most recently updated on March 8^th, 2023. The new information includes additional fixes.

CODESYS published an update that provides additional information for their Control V3 file access advisory that was originally published on February 23^rd, 2023 and most recently updated on March 8^th, 2023. The new information includes additional fixes.

AMD Reports

Binarily published three reports about vulnerabilities in the SMM Driver On AMD-Based Gigabyte Devices. The reports contain proof-of-concept code. These were coordinated disclosures with AMD reporting new versions that mitigate the vulnerability.

The three reported vulnerabilities are:

• Privilege escalation (3) - CVE-2023-20559, CVE-2021-26317, CVE-2023-20558

NOTE: CVE-2021-26317 was reportedly fixed in May 2022.