This week we have nine vendor disclosures from Aruba Networks, Carrier, Contec, Hitachi Energy, HPE (2), InHand Networks, Moxa, and Phoenix Contact. There are five vendor updates from HPE (4) and Moxa. Finally, we have three exploits for products from Eaton, Riello, and Fortinet.
In Part 2 this week I will look at disclosures from Schneider and Siemens.
Aruba Advisory
Aruba published an advisory that describes eight vulnerabilities in their ClearPass Policy Manager program. The vulnerabilities were reported by Daniel Jensen, Luke Young, AT&T Security Team, and Sicarius. Aruba has new versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The eight reported vulnerabilities are:
Unauthenticated arbitrary user creation - CVE-2023-25589,
Privilege escalation - CVE-2023-25590,
Information disclosure - CVE-2023-25591,
Cross-site scripting (2) - CVE-2023-25592 and CVE-2023-25593,
Authorization bypass - CVE-2023-25594, and
Sensitive information disclosure (2) - CVE-2023-25595 and CVE-2023-25596,
Carrier Advisory
Carrier published an advisory that discusses a server side request forgery vulnerability in their g LenelS2 supported platform. This is a third-party (Apache) vulnerability. Carrier has new versions that mitigate the vulnerability.
Contec Advisory
Contec published an advisory that describes three vulnerabilities in their CONPROSYS M2M Gateway Series, M2M Controller Series products. Contec has new versions that mitigate the vulnerabilities.
The three reported vulnerabilities are:
OS command injection - CVE-2023-27917,
Insufficient encryption - CVE-2023-27389, and
Inadequate access restrictions - CVE-2023-23575
Hitachi Energy Advisory
Hitachi published an advisory that discusses a permissions, privileges, and access control vulnerability in their MicroSCADA Pro/X SYS600 Products. This is a third-party (Vupen) vulnerability. Hitachi has new versions that mitigate the vulnerability.
HPE Advisories
HPE published an advisory that discusses eight vulnerabilities in their NonStop servers. These are third-party (OpenSSL) vulnerabilities. HPE has new versions for some of the affected products.
The eight reported vulnerabilities are:
Type confusion - CVE-2023-0286,
Timing based side channel - CVE-2022-4304,
Out-of-bounds read - CVE-2022-4203,
Use after free - CVE-2023-0215,
Double free - CVE-2022-4450, and
NULL pointer dereference (3) - CVE-2023-0216, CVE-2023-0217, and CVE-2023-0401
HPE published an advisory that describes a cross-site scripting vulnerability in their Integrated Lights-Out products. The vulnerability was reported by Jakub Brzozowski with STM Cyber. HPE has new firmware versions that mitigate the vulnerability. There is no indication that Brzozowski has been provide an opportunity to verify the efficacy of the fix.
InHand Advisory
InHand published an advisory that describes five vulnerabilities in their InRouter615-S industrial routers. The vulnerabilities were reported by Zhouyuan Yang of Fortinet's FortiGuard Labs. InHand has a new version that mitigates the vulnerabilities. There is no indication that Zhouyuan has been provided an opportunity to verify the efficacy of the fix.
The five reported vulnerabilities are:
Denial of service - FG-VD-22-101,
Password leak - FG-VD-22-106,
Brute force - FG-VD-22-107, and
Cross-site scripting (2) - FG-VD-22-108 and FG-VD-22-109
NOTE: FortiGuard also reports the following InHand vulnerabilities as being corrected, but does not list the affected product:
Broken access control - FG-VD-22-102, and
Denial of service - FG-VD-22-103 and FG-VD-22-104,
Moxa Advisory
Moxa published an advisory that describes two improper certificate validation vulnerabilities in their NPort 6000 Series and Windows Driver Manager products. The vulnerabilities were reported by Reid Wightman from Dragos. Moxa has new versions that mitigate the vulnerabilities. There is no indication that Reid has been provided an opportunity to verify the efficacy of the fix.
Phoenix Contact Advisory
Phoenix Contact published an advisory that discusses five vulnerabilities in their ENERGY AXC PU product. These are third-party (CODESYS) vulnerabilities. Phoenix Contact has a new version that mitigates the vulnerability.
The five reported vulnerabilities are:
NULL pointer dereference - CVE-2022-22513,
Improper restriction of operations within the bounds of a memory buffer - CVE-2022-22514,
Exposure of resource to wrong sphere - CVE-2022-22515,
Use of insufficiently random values - CVE-2022-22517, and
Uncontrolled resource consumption - CVE-2022-30792
HPE Updates
HPE published an update for their FlexNetwork and FlexFabric Switches advisory that was originally published on July 30th, 2022. The new information includes:
Adding Flexfabric 5710 and 5940 switches, and
Revising the correct "R" version of firmware.
HPE published an update for their OneView for VMware vCenter advisory that was originally published on February 17th, 2023. The new information includes removing unneeded "older OV4VC versions go to support" language.
HPE published an update for their ProLiant Moonshot Servers advisory that was originally published on November 8th, 2022. The new information includes removing CVE-2022-26006 not affected.
HPE published an update for their ProLiant BL/DL/ML Servers advisory that was originally published on November 8th, 2022. The new information includes removing unneeded "older OV4VC versions go to support" language.
Moxa Update
Moxa published an update for their UC Series advisory that was originally published on November 29th, 2022 and most recently updated on February 9th, 2023. The new information includes correcting the original CVE number from CVE-2022-3086 to CVE 2023-1257. The original CVE was incorrectly listed by NCCIC-ICS (who is the CNA) and was corrected without notice on their February 23rd, 2023 update for ICSA-22-333-04.
Eaton Exploit
Yehia Elghaly published an exploit for a denial-of-service vulnerability in the Eaton Webpower UPS. There is no CVE associated with the exploit and there is no indication that Eaton has been contacted. This may be a 0-day exploit.
Reillo Exploit
Ricardo Jose Ruiz Fernandez published an exploit for shell bypass vulnerability in the Riello UPS system. There is no CVE associated with the exploit and there is no indication that Riello has been contacted. This may be a 0-day exploit.
Fortinet Exploit
Jheysel-r7, Zach Hanley, and Gwendal Guegniaud published a Metasploit module for an externally controlled reference to a resource in another sphere vulnerability in the FortiNAC. This vulnerability was previously reported by Fortinet.