This week we have twelve vendor disclosures from Aruba, GE Gas Power (2), Hitachi, Insyde (3), HPE, PulseSecure, QNAP, Siemens, and VMware. We have five vendor updates from Aruba, Dell, HPE, Johnson Controls, and Milestone. We also have 19 researcher reports for products from WECON (15), Fuji Electric (3), and Industrial Control Links (ICL). Finally we have three exploits reported for products from ICL and WebHMI (2).
Aruba Advisory
Aruba published an advisory describing 16 vulnerabilities in their AOS-CX Switches. Some of these are third-party vulnerabilities. The vulnerabilities were reported by Erik de Jong, Jean-francois Raymond, Anton Stiglic, Ingo Schwarze, mooimacow, Hanno Böck, Juraj Somorovsky, and Craig Young. Aruba has new versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The sixteen reported vulnerabilities are:
Command injection (3) - CVE-2021-41000, CVE-2021-41001, CVE-2021-41003,
Uncontrolled resource consumption - CVE-2002-20001 (exploit),
Out-of-bounds read, CVE-2021-3712 (OpenSSL),
ROBOT (10) - CVE-2017-6168, CVE-2017-17382, CVE-2017-17427, CVE-2017-17428, CVE-2017-12373, CVE-2017-13098, CVE-2017-1000385, CVE-2017-13099, CVE-2016-6883, CVE-2012-5081, and
Path traversal - CVE-2021-41002,
GE Advisories
GE published an advisory discussing the GE CIMPLICITY vulnerabilities reported earlier this week. GE Gas Power is currently evaluating the impact of these vulnerabilities on their product line.
GE published an advisory discussing the Blackberry QNX Neutrino Kernel vulnerability. GE Gas Power reports that the vulnerability does not target any GE products specifically.
Hitachi Advisory
Hitachi published an advisory discussing 20 recently reported Microsoft vulnerabilities affecting their Hitachi Disk Array Systems. Hitachi has software updates available to mitigate these vulnerabilities.
The 20 reported vulnerabilities are:
Remote code execution (4) - CVE-2022-21971, CVE-2022-21974, CVE-2022-21992, and CVE-2022-21995,
Improper privilege management (10) - CVE-2022-21981, CVE-2022-21989, CVE-2022-21994, CVE-2022-21997, CVE-2022-21999, CVE-2022-22000, CVE-2022-22001, CVE-2022-22715, CVE-2022-22717, and CVE-2022-22718,
Disclosure of sensitive information - CVE-2022-21985,
Exposure of resource to wrong sphere (2) - CVE-2022-21993 and CVE-2022-21998, and
Uncontrolled resource consumption (3) - CVE-2022-22002, CVE-2022-22710, and CVE-2022-22712,
HPE Advisory
HPE published an advisory describing two vulnerabilities in their OneView Global Dashboard. The vulnerability was reported by Lukasz Plonka. HPE has a new version that mitigates the vulnerabilities. There is no indication that Plonka has been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Cross-site scripting - CVE-2021-29216, and
URL redirection - CVE-2021-29217
Insyde Advisories
Insyde published an advisory describing a privilege escalation vulnerability in their SysPasswordDxe driver. Insyde has new kernels that mitigate the vulnerability.
Insyde published an advisory describing a buffer overflow vulnerability in their VariableEditSmm driver. Insyde has a new version that mitigates the vulnerability.
Insyde published an advisory describing a plain-text storage of sensitive information vulnerability in their HddPasswordPei driver. Insyde has a new kernel that mitigates the vulnerability.
PulseSecure Advisory
PulseSecure published an advisory describing an integer overflow or wrap around vulnerability in multiple product lines. This is a third-party (libexpat) vulnerability. PulseSecure has updates planned for April 2022.
QNAP Advisory
QNAP published an advisory describing two cross-site scripting vulnerabilities in their NAS running Proxy Server. The vulnerabilities were reported by Tony Martin. QNAP has a new version that mitigates the vulnerabilities. There is no indication that Martin has been provided an opportunity to verify the efficacy of the fix.
Siemens Advisory
Siemens published an advisory discussing 23 vulnerabilities in their Industrial Products. These are third-party (Insyde) vulnerabilities. Siemens provides generic workarounds pending development of fixes.
The 23 reported vulnerabilities are:
Untrusted pointer dereference - CVE-2020-5953,
Improper privilege management - CVE-2020-27339,
Improper restriction of operations within the bounds of a memory buffer (4) - CVE-2021-33625, CVE-2021-33627, CVE-2021-41837, and CVE-2021-41838,
Inclusion of functionality from untrusted control sphere (2) - CVE-2021-33626 and CVE-2021-41841,
NULL pointer dereference - CVE-2021-41839,
Allocation of resources without limit or throttling - CVE-2021-41840,
Out-of-bounds write (6) - CVE-2021-42059, CVE-2021-42554, CVE-2021-43522, CVE-2021-43615, CVE-2022-24030, and CVE-2022-24031,
Improper input validation (4) - CVE-2021-42060, CVE-2021-42113, CVE-2021-43323, and CVE-2022-24069, and
Classic buffer overflow (3) - CVE-2021-45969, CVE-2021-45970, and CVE-2021-45971,
VMware Advisory
VMware published an advisory describing a cross-site scripting vulnerability in their Workspace ONE Boxer. The vulnerability was reported by Eugene Lim. VMware has new version that mitigates the vulnerability. There is no indication that Lim has been provided an opportunity to verify the efficacy of the fix.
Aruba Update
Aruba published an update for their PwnKit advisory that was originally published on February 1st, 2022. The new information includes updating affected products and resolution with ClearPass and ALE details.
Dell Update
Dell published an update for their generic Log4Shell advisory.
HPE Update
HPE published an update for their PwnKit advisory that was originally published on February 1st 2022. See Aruba update above.
Johnson Controls Update
Johnson Controls published an update for their Log4Shell advisory. The new information includes adding MX T2000 Marine Pane to the not affected list.
Milestone Update
Milestone published an update for their Log4Shell advisory. The new information includes noting that their Husky IVO, M- and X-series products indirectly use Log4j, but not a version affected by the Log4Shell vulnerabilities.
WECON Reports
The Zero Day Initiative published 15 reports of vulnerabilities in the WECON LeviStudioU. The vulnerabilities were reported by Natnael Samson. These vulnerabilities were coordinated with NCCIC-ICS. ZDI is reporting these as 0-day vulnerabilities.
The 15 reported vulnerabilities are:
Stack-based buffer overflow - ZDI-22-404, ZDI-22-403, ZDI-22-402, ZDI-22-401, ZDI-22-400, ZDI-22-399, ZDI-22-398, ZDI-22-397, ZDI-22-396, ZDI-22-395, ZDI-22-394, ZDI-22-393, ZDI-22-392, ZDI-22-391, and ZDI-22-390.
Fuji Reports
ZDI published 3 reports of vulnerabilities in the Fuji Electric Alpha5 servo amplifiers. The vulnerabilities were reported by xina1i. These vulnerabilities were coordinated with NCCIC-ICS who reported that the vulnerabilities had been fixed.
The three reported vulnerabilities are:
Stack-based buffer overflow - ZDI-22-389,
Out-of-bounds read - ZDI-22-388, and
Unitialized pointer - ZDI-22-387
ICL Report
Zero Science published a report describing a file write/overwrite and delete vulnerability in the ICL ScadaFlex II SCADA Controllers SC-1/SC-2. Zero Science received no reply from ICL about the vulnerability.
ICL Exploit
LiquidWorm published an exploit for the ICL vulnerability reported above. This apparently a 0-day exploit.
HMI Exploits
Antonio Cuomo published an exploit for a remote code execution vulnerability in WebHMI version 4.1.1. There is no CVE listed, nor any comments about contact with WebHMI. This may be a 0-day exploit.
Antonio Cuomo published an exploit for cross-site scripting vulnerability in WebHMI 4.1. There is no CVE listed, nor any comments about contact with WebHMI. This may be a 0-day exploit.