Public ICS Disclosures – Week of 1-6-24 - Part 2

For Part 2 we have an additional vendor advisory from Schneider. Finally, we also have 17 vendor updates from Schneider (6) and Siemens (11).

Schneider Advisory

Schneider published an advisory that describes three vulnerabilities in their s EcoStruxure Control Expert, EcoStruxure Process Expert and Modicon M340, M580 PLCs. The vulnerabilities were reported separately by Gao Jian, Jianshuang Ding, and Kaikai Yang. Schneider has new versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Schneider Updates

Schneider published an update for their CODESYS Runtime advisory that was originally published on July 11^th, 2023 and most recently updated on August 8^th, 2023. The new information includes adding remediations for different products.

Schneider published an update for their EcoStruxure Control Expert advisory that was originally published on April 11^th, 2023. The new information includes adding remediation for EcoStruxure Control Expert.

Schneider published an update for their CODESYS Runtime Vulnerabilities advisory that was originally published on April 11^th, 2023. The new information includes adding remediation for for CVE-2022-4224

for Harmony HMISCU Controller HMISCU, Modicon Controllers M241 / M251 / M262 and PacDrive Controllers LMC Eco/Pro/Pro2

Schneider published an update for their s EcoStruxure Control Expert advisory that was originally published on January 10^th, 2023 and most recently updated on August 8^th, 2023. The new information includes adding remediation for for Modicon M580.

Schneider published an update for their ISaGRAF advisory that was originally published on June 8^th, 2021 and most recently updated on March 14^th, 2023. The new information includes adding mitigations for PowerLogic T300, MiCOM C264 D7.21 (or later) OR Easergy C5 1.1.6 (or later), PACiS GTW, and EPAS GTW

Schneider published an update for their Harmony HMI Panels advisory that was originally published on August 13^th, 2019 and most recently updated on February 8^th, 2022. The new information includes adding a fix for Harmony/Magelis HMISCU.

Siemens Updates

Siemens published an update for their User Management Component advisory that was originally published on December 12^th 2023. The new information includes adding fix for Totally Integrated Automation Portal (TIA Portal) V17.

Siemens published an update for their SiNVR/SiVMS Video Server advisory that was originally published on March 10^th, 2020 and most recently updated on August 10^th, 2021. The new information includes removing orphaned links to vendor advisories and software downloads.

Siemens published an update for their Linux Kernel of the SIMATIC S7-1500 advisory that was originally published on June 13^th, 2023 and most recently updated on December 12^th, 2023. The new information includes adding CVE-2023-48795 (Terrapin-Attack vulnerability).

Siemens published an update for their OpenSSL Vulnerabilities advisory that was originally published on July 13^th, 2021 and most recently updated on March 14^th, 2023. The new information includes adding fix for SIMATIC WinCC TeleControl.

Siemens published an update for their Control Center Server advisory that was originally published on April 13^th, 2023. The new information includes removing orphaned links to vendor advisories and software downloads.

Siemens published an update for their SiNVR/SiVMS Video Server advisory that was originally published on December 10^th, 2019 and most recently updated on April 13^th, 2021. The new information includes removing orphaned links to vendor advisories and software downloads.

Siemens published an update for their n OpenSSL (CVE-2022-0778) advisory that was originally published on June 14^th, 2022 and most recently updated on October 10^th, 2023. The new information includes:

• Adding fix for SIMATIC PCS 7 TeleControl, and

• Clarifying that no fix is planned for SINAUT Software ST7sc and SINAUT ST7CC

Siemens published an update for their e OPC UA Implementations of SIMATIC Products advisory that was originally published on September 12^th, 2023 and most recently updated on December 12^th, 2023. The new information includes announcing that no fix planned for SIMATIC IPC DiagMonitor.

Siemens published an update for their SICAM Q100 advisory that was originally published on November 8^th, 2023. The new information includes adding legacy Q100 device models (-0AA1) which are also affected and provide the same fix version.

Siemens published an update for their Web Interface of SICAM Q100 advisory that was originally published on December 12^th, 2023. The new information includes adding legacy Q100 device models (-0AA1) which are also affected and provide the same fix version.

Siemens published an update for their GNU/Linux subsystem of the SIMATIC S7-1500 CPU advisory that was originally published on December 12^th, 2023. The new information include CVE-2021-44879 (exploit), CVE-2023-46218 (exploit), CVE-2023-46219 (exploit), and CVE-2023-48795 (Terrapin-Attack vulnerability).