Today, CISA’s NCCIC-ICS published seven control system security advisories for products from Rockwell Automation, Honeywell, and Siemens (5). They also updated an advisory for products from AVEVA.
Siemens published two additional advisories on Tuesday that were not addressed here. They also updated 22 advisories, but NCCIC-ICS is no longer covering updates for Siemens products. I will be covering all of those this weekend.
Rockwell Advisory
This advisory describes an exposure of sensitive information to an unauthorized actor vulnerability in the Rockwell Modbus TCP Server AOI. The vulnerability was reported by Veermata Jijabai Technological Institute. Rockwell has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthorized user to read the connected device’s Modbus TCP Server AOI information.
Honeywell Advisory
This advisory describes three vulnerabilities in the Honeywell OneWireless Wireless Device Manager (WDM). The vulnerabilities were reported by the UK's National Cyber Security Centre (NCSC). Honeywell has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to disclose sensitive information, allow privilege escalation, or allow remote code execution.
Mendix Advisory
This advisory describes an incorrect implementation of authentication algorithm vulnerability in the Siemens Mendix SAML Module. The vulnerability is self-reported. Siemens has new versions that mitigate the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow unauthenticated remote attackers to bypass authentication and gain access to the application.
SCALANCE Advisory
This advisory discusses four vulnerabilities in the Siemens SCALANCE W1750D. These are third-party (OpenSSL) vulnerabilities. Siemens provides generic workarounds to mitigate the vulnerabilities.
The four reported vulnerabilities are:
Inadequate encryption strength - CVE-2022-4304,
Double free - CVE-2022-4450,
Use after free - CVE-2023-0215, and
Improper input validation - CVE-2023-0286
NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerabilities to allow an attacker to read memory contents, decrypt RSA-encrypted messages, or create a denial-of-service condition.
RUGGEDCOM Advisory #1
This advisory describes two missing authorization vulnerabilities in the Siemens RUGGEDCOM CROSSBOW. The vulnerabilities are self-reported. Siemens has a new version that mitigates the vulnerabilities.
NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow authenticated remote attackers to perform unauthorized actions.
RUGGEDCOM Advisory #2
This advisory describes two vulnerabilities in the Siemens RUGGEDCOM CROSSBOW. One of the vulnerabilities was reported by Cameron Whitehead from RISES Center. Siemens has a new version that mitigates the vulnerabilities. There is no indication that Whitehead has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow authenticated remote attackers to access restricted data or execute arbitrary database queries via an SQL injection attack.
Third-Party Advisory
This advisory describes 65 vulnerabilities in the Siemens SCALANCE and RUGGEDCOM products. These are third-party (Busybox Applet, Linux Kernal, and OpenSSL, OpenVPN) vulnerabilities. Siemens has new versions that mitigate the thve vulnerabilities.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to inject code or cause a denial-of-service condition.
AVEVA Update
This update provides additional information on an advisory that was originally published on December 8th, 2022. The new information includes:
Adding Plant SCADA Access Anywhere as an affected product,
Adding two new CVE, CVE-2021-3711 and CVE-2020-11022, and
Adding fix for Plant SCADA Access Anywhere and new CVEs.