This week we have fifteen vendor disclosures from Bosch, Circutor (2), Dell, Gallagher (7), QNAP (3), and Xylem. We also have a researcher report for products from New Electronic Technologies. Finally we have exploits for products from VMware and Solar-Log (2).
BOSCH Advisory
Bosch published an advisory describing five vulnerabilities in their IP Cameras. The vulnerabilities are self-reported. Bosch has new firmware versions that mitigate the vulnerabilities.
The five reported vulnerabilities are:
Improper authentication - CVE-2021-23847,
Cross-site scripting (2) - CVE-2021-23848 and CVE-2021-23854,
Uncontrolled resource consumption - CVE-2021-23852, and
Improper input validation - CVE-2021-23853
Circutor Advisories
Incibe-CERT published an advisory describing an improper authentication vulnerability in the Circutor SGE-PLC1000 device. The vulnerability was reported by Aarón Flecha Menéndez of S21sec. Circutor has a new firmware version that mitigates the vulnerability. There is no indication that Menendez has been provided an opportunity to verify the efficacy of the fix.
Incibe-CERT published an advisory describing an OS command injection vulnerability in the Circutor SGE-PLC1000 device. The vulnerability was reported by Aarón Flecha Menéndez of S21sec. Circutor has a new firmware version that mitigates the vulnerability. There is no indication that Menendez has been provided an opportunity to verify the efficacy of the fix.
Dell Advisory
Dell published an advisory discussing the VMware vCenter Server vulnerabilities. It provides a list of affected products and links to mitigation measures. Affected products include:
Dell Integrated Data Protection Appliance,
VxRail,
Dell EMC PowerFlex Rack, and
VxBlock
Gallagher Advisories
Gallagher published seven advisories describing vulnerabilities in the Command Centre Server. The associated vulnerabilities are self-reported. Gallagher has maintenance releases that mitigate the vulnerabilities.
The reported vulnerabilities are:
Improper authorization - CVE-2021-23136, CVE-2021-23140,
Clear-text storage of sensitive information in memory - CVE-2021-23182, CVE-2021-23211,
Exposure of sensitive information to an unauthorized actor - CVE-2021-23204,
Improper encoding or escaping - CVE-2021-23205, and
SQL injection - CVE-2021-23230
NOTE: Links are to the individual advisories.
QNAP Advisories
QNAP published an advisory describing an improper access control vulnerability in their QNAP NAS Helpdesk products. The vulnerability was reported by Thomas Fady. QNAP has a new version that mitigates the vulnerability. There is no indication that Fady has been provided an opportunity to verify the efficacy of the fix.
QNAP published an advisory describing an inclusion of sensitive information in QSS vulnerability in their QNAP Switches. The vulnerability was reported by Jan Hoff. QNAP has a firmware update that mitigates the vulnerability. There is no indication that Hoff has been provided an opportunity to verify the efficacy of the fix.
QNAP published an advisory describing an out-of-bounds read vulnerability in their QNAP Switches. The vulnerability was reported by Qian Chen from Codesafe Team of Legendsec. QNAP has a firmware update that mitigates the vulnerability. There is no indication that Qian has been provided an opportunity to verify the efficacy of the fix.
Xylem Advisory
Xylem published an advisory discussing the Rockwell ISaGRAF Runtime vulnerabilities in their Flygt MultiSmart pump station management system. Xylem provides a list of affected products and has new firmware versions available to mitigate the vulnerabilities.
New Electronic Technologies Report
The Russian BDU FSTEC published a report describing a privilege management vulnerability in the New Technologies Titanium CNC PLC module. BDU FSTEC reports that there is a software update that mitigates the vulnerability.
VMware Exploit
Johnny Yu published an exploit for a heap-based buffer overflow vulnerability in the VMware vCenter Server. VMware published an advisory describing this vulnerability in February.
Solar-Log Exploits
Luca Chiou published an exploit for an unprotected storage of credentials vulnerability in the Solar-Log Energy Management System. There is no CVE listed nor is there any indication that the vendor has been contacted; this may be a 0-day exploit. Chiou provides SHODAN search criteria for finding affected systems.
Luca Chiou published an exploit for an incorrect access control vulnerability in the Solar-Log Energy Management System. There is no CVE listed nor is there any indication that the vendor has been contacted; this may be a 0-day exploit. Chiou provides SHODAN search criteria for finding affected systems.