Public ICS Disclosures – Week of 2-10-24 - Part 2

For Part 2 we have four additional vendor disclosures from Schneider (3) and WatchGuard. There are also ten vendor updates from Dell, Schnieder, and Siemens (8). Finally, we have two exploits for products from Vimesa and Splunk.

Schneider Advisories

Schneider published an advisory that describes three vulnerabilities in multiple Schneider products. The vulnerabilities were reported separately by Gao Jian, Jianshuang Ding, and Kaikai Yang. Schneider has new versions of some of the affected products that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper enforcement of message integrity during transmission in a communications channel - CVE-2023-6408,

• Use of hard-coded credentials - CVE-2023-6409, and

• Insufficiently protected credentials - CVE-2023-27975

Schneider published an advisory that describes an improper authentication vulnerability in their Harmony Relay NFC products. The vulnerability was reported by Thierry Decroix of WithSecure. Schneider provides generic mitigation measures pending development of a fix.

Schneider published an advisory that describes a use of hard-coded credentials vulnerability in their EcoStruxure IT Gateway product. The vulnerability was reported by an anonymous researcher via the Zero Day Initiative. Schneider has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

WatchGuard Advisory

WatchGuard published an advisory that discusses a lighttpd denial of service vulnerability. WatchGuard reports that none of their products are affected.

Dell Update

Dell published an update for their Wyse Management Suite advisory that was originally published on December 19^th, 2022.

Schneider Update

Schneider published an update for their Modicon Controllers advisory that was originally published on May 14^th, 2019 and most recently updated on March 14^th, 2023. The new information includes:

• Adding fix for Modicon M340 and M580 (page 6) for CVE2018-7855, and

• Updating products affected version numbers.

Siemens Updates

Siemens published an update for their User Management Component advisory that was originally published on December 12^th, 2023 and most recently updated on January 9^th, 2024. The new information includes fix for Opcenter Quality as well as product and fix for SINEC NMS.

Siemens published an update for their Linux Kernel of the SIMATIC S7-1500 advisory that was originally published on June 13^th, 2023 and most recently updated on January 9^th, 2024. The new information includes adding CVE-2020-12762, CVE-2023-6606, CVE-2023-6931, CVE-2023-6932,

CVE-2023-7008, CVE-2023-7104, CVE-2023-36660, CVE-2023-50495, CVE2023-51384, CVE-2023 51385, CVE-2023-51767, CVE-2024-0232, CVE-2024-0553, CVE-2024-0567, CVE-2024-0584, CVE-2024-0684, CVE-2024-22365, CVE2024-25062

Siemens published an update for their OPC UA Implementations advisory that was originally published on September 12^th, 2023 and most recently updated on January 9^th, 2024. The new information includes:

Adding fix for SIMATIC WinCC Unified OPC UA Client/Server; Added SIMATIC PCS 7 V9.1 as affected, and

Adding specific mitigation measure for CVE-2023-28831 (disable OPC UA)

Siemens published an update for their GNU/Linux subsystem of the SIMATIC S7-1500 that was originally published on November 27^th, 2018 and most recently updated on December 12^th, 2023. The new information includes clarifying that this document will no longer be updated.

Siemens published an update for their DHCP Client of Nucleus RTOS advisory that was originally published on November 12^th, 2023. The new information includes:

• Consolidating list of products,

• Renaming Capital VSTAR to Capital Embedded AR Classic,

• Adding fix and mitigation for Capital Embedded AR Classic,

• Adding CVSSv4.0 vector and score

Siemens published an update for their GNU/Linux subsystem of the SIMATIC S7-1500 CPU advisory that was originally published on December 12^th, 2023 and most recently updated on January 9^th, 2024. The new information includes adding CVE-2023-45898, CVE-2023-46862, CVE-2023-6121, CVE-2023-6817, CVE-2023-6931, CVE-2023-6932, CVE-2024-0584

Siemens published an update for their Siemens Industrial Products advisory that was originally published on August 10^th, 2021 and most recently updated on November 14^th, 2023. The new information includes adding fix for SIMATIC IPC527G.

Siemens published an update for their IPv6 Stack of Nucleus RTOS advisory that was originally published on April 13^th, 2021 and most recently updated on November 9^th, 2021. The new information includes:

• Renaming Capital VSTAR to Capital Embedded AR Classic,

• Adding fix and mitigation for Capital Embedded AR Classic, and

• Adding CVSSv4.0 vector and score

Vimesa Exploit

LIQUIDWORM published an exploit for a denial of service vulnerability in the Vimsea Blue Plus VHF/FM radio transmitter. There is no CVE associated with the vulnerability and no indication that the researcher has been contacted. This may be a 0-day exploit.

Splunk Exploit

Parsa Rezaie Khiabanloo published an exploit for an information disclosure vulnerability in Splunk. There is no CVE associated with the vulnerability and no indication that the researcher has been contacted. This may be a 0-day exploit.