This has been a very busy week for control system vulnerabilities and it is going to require a two-part post to address all of the information. This week we have 14 vendor disclosures from ABB (3), Aruba (3), Sante, Sealevel, WAGO, Emerson, FANUC, Honeywell (2), Philips, and Rockwell.
ABB Advisories
ABB published an advisory describing three vulnerabilities in their SPIET800 INFI-Net to Ethernet Transfer and PNI800 S+ Ethernet communication interface modules. The vulnerabilities were reported by Ron Brash and Lance Lamont from Verve Industrial Protection. ABB provides generic workarounds pending development of mitigation measures.
The three reported vulnerabilities are:
Incorrect handling of OoO packets - CVE-2021- 22285,
Malformed packet handling - CVE-2021- 22286, and
Unresponsive after TCP scan - CVE-2021- 22288
ABB published an advisory describing an improper input validation vulnerability in their System 800xA, Symphony® Plus IEC 61850 communication stack. The vulnerability was reported by GAI netConsult through Hitachi Energy. ABB has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
NOTE: This vulnerability was originally reported in Hitachi Energy products in March of last year.
ABB published an advisory describing a remote code execution vulnerability in their OPC Server for AC 800M products. The vulnerability was reported by William Knowles at Applied Risk. ABB has new versions that mitigate the vulnerability. There is no indication that Knowles has been provided an opportunity to verify the efficacy of the fix.
Aruba Advisories
Aruba published an advisory discussing 15 vulnerabilities in their ArubaOS-CX 8000 Series Switches. These are third-party (Insyde - UEFI Bios) vulnerabilities. Aruba provides generic work arounds pending development of mitigation measures.
The fifteen reported vulnerabilities are:
Privilege escalation - CVE-2020-5953, CVE-2021-41840, CVE-2021-41841, CVE-2021-41839,
Improper privilege management - CVE-2020-27339,
Buffer allocation pointer - CVE-2021-33626, CVE-2021-33627,
Unsafe pointer - CVE-2021-41838, CVE-2021-41837,
SMM callout - CVE-2021-43323, CVE-2021-42113,
Out-of-bounds write - CVE-2021-42554, CVE-2021-33625, CVE-2021-43522,
Stack overflow - CVE-2021-42059
Aruba published an advisory discussing 15 vulnerabilities in their 9000 Series Gateways. These are the same third-party vulnerabilities described above.
Aruba published an advisory discussing the PwnKit vulnerability in multiple product lines. This is a third-party (Linux) vulnerability. Aruba provides generic workarounds pending development of mitigation measures. The advisory provides lists of affected and confirmed unaffected products.
Sante Advisory
INCIBE-CERT published an advisory describing seven vulnerabilities in the Sante DICOM Viewer Pro. The vulnerabilities were reported by Tran Van Khang ( khangkito ) of VinCSS, and Mat Powell via the Zero Day Initiative. Sante has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The seven reported vulnerabilities are:
Out-of-bounds write (5) - CVE-2022-24056, CVE-2022-24057, CVE-2022-24058, CVE-2022-24059, and CVE-2022-24064,
Use-after free - CVE-2022-24062, and
Improper data validation - CVE-2022-24063
Sealevel Advisory
INCIBE-CERT published an advisory describing twelve vulnerabilities in the Sealevel SeaConnect 370W Wi-Fi edge device. These are third-party (Eclipse MQTTClient-C library) vulnerabilities. The vulnerabilities were reported by Francesco Benvenuto and Matt Wiseman of Cisco Talos. The reports include proof-of-concept code. No mitigation measures have yet been developed.
The twelve reported vulnerabilities are:
Certificate validation - CVE-2021-21959,
Update task overwrite - CVE-2021-21968,
Heap-based buffer overflow - CVE-2021-21962,
Out-of-bounds write (5) - CVE-2021-21969, CVE-2021-21970, CVE-2021-41036, CVE-2021-21971, and CVE-2021-21967,
Information disclosure - CVE-2021-21963,
Stack-based buffer overflow (2) - CVE-2021-21960, and CVE-2021-21961, and
Denial of service (2) - CVE-2021-21964, and CVE-2021-21965
WAGO Advisory
CERT-VDE published an advisory discussing a link following vulnerability in the WAGO e!COCKPIT and WAGO-I/O-Pro. This is a third-party (WIBU-Systems) vulnerability. WAGO recommends installing the latest version of the WIBU Codemeter pending development of mitigation measures.
Emerson Advisory
Emerson published an advisory describing a credential disclosure vulnerability in multiple products. The vulnerability was reported by Dragos. Emerson has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
FANUC Advisory
FANUC published a notice reporting that none of their products are affected by the Log4Shell vulnerability.
Honeywell Advisories
Honeywell published an advisory describing a command injection vulnerability in their IP PTZ Camera HDZP252DI. The vulnerability was reported by Dave Burke of Fathom5. Honeywell has new firmware versions that mitigate the vulnerability. There is no indication that Burke has been provided an opportunity to verify the efficacy of the fix.
Honeywell published an advisory describing a video replay vulnerability in their IP Camera HBW2PER1. The vulnerability was reported by Dave Burke of Fathom5. Honeywell has new firmware versions that mitigate the vulnerability. There is no indication that Burke has been provided an opportunity to verify the efficacy of the fix.
Philips Advisory
Philips published an advisory discussing the PwnKit vulnerability. They reported that none of their products are affected.
Rockwell Advisory
Rockwell published a notice discussing a problem with the latest Microsoft® DCOM Hardening patch. Some Rockwell products are unable to establish proper DCOM connection after installing the patch. The notice provides separate lists of products that are directly and indirectly affected by the problem. Rockwell provides a workaround pending development of mitigation measures.