Additionally, this week, we have four vendor disclosures from Schneider Electric. There are also six updates available for advisories from Schneider (4) and Siemens (2). Finally, we have a research report for vulnerabilities in three message broker applications.
Schneider Advisories
Schneider published an advisory describing two vulnerabilities in their PowerLogic PM55xx and PowerLogic PM8ECC products. The vulnerabilities were reported by Jacob Baines of Dragos. Schneider has a new firmware version that mitigates the vulnerabilities in some of the covered products. There is no indication that Baines has been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Weak password recovery mechanism for forgotten password - CVE-2021-22763, and
Improper authentication - CVE-2021-22764
Schneider published an advisory describing six vulnerabilities in their PowerLogic EGX100 and EGX300
products. The vulnerabilities were reported by Jacob Baines of Dragos. The affected products are no longer supported so Schneider only provides generic mitigation measures.
The six reported vulnerabilities are:
Weak password recovery mechanism for forgotten password - CVE-2021-22763,
Improper authentication - CVE-2021-22764, and
Improper input validation (4) - CVE-2021-22765, CVE-2021-22766, CVE-2021-22767, and CVE-2021-22768
Schneider published an advisory discussing the ISaGRAF vulnerabilities in their IEC 61131-3 Programming and Engineering Tools. Schneider provides a list of affected products and mitigation measures.
Schneider published an advisory describing an improper privilege management vulnerability in their Enerlin'X Com’X 510 product. The vulnerability was reported by Maxim Rupp. Schneider has a new firmware version that partially mitigates the vulnerability.
Schneider Updates
Schneider published an update for their EcoStruxure™ Machine Expert advisory that was originally published on May 11th, 2021. The new information includes removing Vijeo Designer from the list of affected products.
Schneider published an update for their C-bus Toolkit advisory that was originally published on April 15, 2021. The new information includes adding CVE-2021-22748 (path traversal).
NOTE: NCCIC-ICS should be updating their advisory (ICSA-21-105-01) this coming week.
Schneider published an update for their PLC Simulator advisory that was originally published on November 10th, 2020. The new information includes adding PLC Simulator for Ecostruxure Process Expert to the list of affected products.
NOTE: NCCIC-ICS should be updating their advisory (ICSA-20-315-03) this coming week.
Schneider published an update for their Modicon Controllers advisory that was originally published on May 18th, 2019. The new information includes adding mitigation measures for CRA modules (RIO Drop Adapters) .
NOTE: NCCIC-ICS should be updating their advisory (ICSA-19-136-01) this coming week.
Siemens Updates
Siemens published an update for the Industrial Software advisory that was originally published on July 9th, 2020 and most recently updated on March 9th, 2021. The new information includes:
Adding mitigation measures for r SIMATIC Automation Tool, and
Updating mitigation measures for SINEC NMS
NOTE: NCCIC-ICS should be updating their advisory (ICSA-20-161-04) this coming week.
Siemens published an update for their Industrial PCs advisory that was originally published on May 11th, 2021. The new information includes adding mitigation measures for:
SIMATIC IPC427E,
SIMATIC IPC477E (PRO), and
SIMATIC IPC527G
Message Application Report
Synopsys Cybersecurity Research Center published a report describing separate denial of service vulnerabilities in three message broker applications used in many IoT communications processes. The three products are:
RabbitMQ (CVE-2021-22116),
EMQ X (CVE-2021-33175), and
VerneMQ (CVE-2021-33176)
NOTE: The link provided above is to the Tanzu/VMware advisory on the RabbitMQ vulnerability.