IBC Solar ServeMaster Source Code Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified three vulnerabilities in IBC Solar products. The vulnerabilities are disclosure of applications source code, plain text passwords, and cross site scripting. IBC Solar has not produced a patch to mitigate these vulnerabilities. These...

Harman-Kardon Uconnect Vulnerability

OVERVIEW This advisory is a follow-up to the ICS-ALERT titled ICS-ALERT-15-203-01 FCA Uconnect VulnerabilityICS-CERT ALERT, https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-203-01, web site last accessed September 17, 2015. that was published July 22, 2015, on the NCCIC/ICS-CERT web site. Chris...

Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability

OVERVIEW Independent researcher Artyom Kurbatov has identified a cleartext transmission vulnerability in Schneider Electric’s StruxureWare Building Expert product. Schneider Electric has produced a new firmware version that mitigates this vulnerability. Artyom Kurbatov has tested the new firmware...

GE MDS PulseNET Vulnerabilities

OVERVIEW NCCIC/ICS-CERT received a report from HP’s Zero Day Initiative ZDI concerning two vulnerabilities in GE’s MDS PulseNET and MDS PulseNET Enterprise Network Management Software. These vulnerabilities were reported to ZDI by security researcher Andrea Micalizzi. GE has produced a new versio...

Advantech WebAccess Stack-Based Buffer Overflow Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a stack-based buffer overflow vulnerability in Advantech’s WebAccess application. Advantech has produced a new version to mitigate this vulnerability. Ivan Sanchez has tested the new version to validate that it resolves the vulnerability...

Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-15-169-01A Wind River VxWorks TCP Predictability Vulnerability in ICS Devices that was published November 5, 2015, on the NCCIC/ICS-CERT web site. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a...

Yokogawa Multiple Products Buffer Overflow Vulnerabilities

OVERVIEW Yokogawa Electric Corporation has notified NCCIC/ICS-CERT of stack-based buffer overflow vulnerabilities in multiple Yokogawa products. Yokogawa has released product revisions that mitigate the vulnerabilities for many of the vulnerable products. These vulnerabilities could be exploited...

Advantech WebAccess Buffer Overflow Vulnerability

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-251-01 Advantech WebAccess Buffer Overflow Vulnerability that was published September 8, 2015, on the NCCIC/ICS-CERT web site. Security researcher Praveen Darshanam reported a stack-based overflow vulnerability ...

N-Tron 702W Hard-Coded SSH and HTTPS Encryption Keys (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-160-01 N-Tron 702W Hard-Coded SSH and HTTPS Encryption Keys that was published June 9, 2015, on the NCCIC/ICS-CERT web site. Independent researcher Neil Smith has identified hard-coded SSH and HTTPS encryption...

Schneider Electric Modicon PLC Vulnerabilities

OVERVIEW This advisory is a follow-up to the alert titled ICS-ALERT-15-224-02 Schneider Electric Modicon M340 PLC Station P34 Module VulnerabilitiesICS-CERT ALERT, https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-02, web site last accessed September 3, 2015. that was published August 12, 2015...

Cogent DataHub Code Injection Vulnerability

OVERVIEW NCCIC/ICS-CERT has become aware of a code injection vulnerability affecting the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. An anonymous security researcher reported this vulnerability to HP’s Zero Day Initiative ZDI. A patch to mitigate this issue was released ...

Moxa Industrial Managed Switch Vulnerabilities

OVERVIEW Erwin Paternotte of Applied RiskApplied Risk Security Advisory AR2015001, Multiple Vulnerabilities in Moxa industrial manages switches, http://applied-risk.com/application/files/3414/4060/7148/AdvisoryMoxaMultipleVulnerabilities.pdf, web site last accessed September 3, 2015. has identifi...

Siemens RUGGEDCOM ROS IP Forwarding Vulnerability

OVERVIEW Stephen Craven of the Tennessee Valley Authority TVA has identified an IP forwarding vulnerability in older versions of Siemens RUGGEDCOM ROS. Siemens recommends updating to the latest version to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUC...

Moxa SoftCMS Buffer Overflow Vulnerabilities

OVERVIEW NCCIC/ICS-CERT received a report from HP’s Zero Day Initiative ZDI concerning buffer overflow vulnerabilities in Moxa’s SoftCMS software package. These vulnerabilities were reported to ZDI by security researcher Carsten Eiram of Risk Based Security, who identified seven vulnerabilities,...

Innominate mGuard VPN Vulnerability

OVERVIEW Innominate mGuard has self identified a denial-of-service DoS vulnerability in the Innominate mGuard device. Inominate has produced a patch to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following mGuard versions are affected:...

Siemens SIMATIC S7-1200 CSRF Vulnerability

OVERVIEW Siemens has identified an CSRF Cross-Site Request Forgery vulnerability in the SIMATIC S7‑1200 CPUs. This vulnerability was reported directly to Siemens by Ralf Spenneberg, Hendrik Schwartke, and Maik Brüggemann from OpenSource Training. Siemens has produced a firmware update to mitigate...

Endress+Hauser HART Device DTM Vulnerability

OVERVIEW Alexander Bolshev and Svetlana Cherkasova of Digital Security have identified an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager DTM library used in Endress+Hauser HART Device DTM. CodeWrights GmbH has addressed the vulnerability with a new library, which...

EasyIO-30P-SF Hard-Coded Credential Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on August 25, 2015, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified a hard-coded credential vulnerability in the EasyIO-30P-SF controller. EasyIO has produced a...

Everest Software PeakHMI Pointer Dereference Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on August 20, 2015, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Josep Pi Rodriguez has identified two-pointer dereference vulnerabilities in the Everest Software LLC PeakHMI...

Schneider Electric IMT25 DTM Vulnerability

OVERVIEW Alexander Bolshev, Gleb Cherbov, and Svetlana Cherkasova of Digital Security have identified a memory corruption vulnerability in Schneider Electric IMT25 DTM component. Schneider Electric has produced a patch that mitigates this vulnerability. Digital Security has tested this patch to...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Password Storage Vulnerability

OVERVIEW Gleb Gritsai, Alisa Esage Shevchenko, Ilya Karpov, and the team from Positive Technologies Security have found sensitive information stored in clear text in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 products. Schneider Electric has released new patches t...

Siemens Sm@rtClient Password Storage Vulnerability

OVERVIEW Siemens has identified a password storage vulnerability in its Sm@rtClient Android application. This vulnerability was reported directly to Siemens by Karsten Sohr from Universität Bremen and Stephan Huber from Fraunhofer SIT. Siemens has produced a new version to mitigate this...

Siemens RUGGEDCOM ROS and ROX-based Devices TLS POODLE Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the advisory titled ICSA-15-202-03A Siemens RUGGEDCOM ROS and ROX Based Devices TLS POODLE Vulnerability that was published July 25, 2015, on the NCCIC/ICS-CERT web site. Siemens has reported to ICS-CERT that a Transport Layer Security TLS Padding...

Siemens SIPROTEC Denial-of-Service Vulnerability

OVERVIEW Siemens has identified a denial-of-service vulnerability in the SIPROTEC 4 and SIPROTEC Compact devices. This vulnerability was reported directly to Siemens by Victor Nikitin from i‑Grids LLC Russia. Siemens has produced a new firmware update to mitigate this vulnerability. This...

Siemens SICAM MIC Authentication Bypass Vulnerability

OVERVIEW Siemens has identified an authentication bypass vulnerability in its SICAM MIC telecontrol device. This vulnerability was reported directly to Siemens by Philippe Oechslin from Objectif Sécurité. Siemens has produced a new firmware update to mitigate this vulnerability. This vulnerabilit...

Baxter SIGMA Spectrum Infusion System Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 30, 2015, and is being released to the NCCIC/ICS-CERT web site. Researcher Jared Bird with Allina IS Security identified four vulnerabilities in Baxter’s SIGMA Spectrum Infusion System. Baxter has released a...

SMA Solar Technology AG Sunny WebBox Hard-Coded Account Vulnerability

OVERVIEW This updated advisory is a follow-up to the advisory titled ICSA-15-181-02 SMA Solar Technology AG Sunny WebBox Hard-Coded Account Vulnerability that was published September 3, 2015, on the NCCIC/ICS-CERT web site. Aleksandr Timorin of PT Security has identified a hard-coded account...

PACTware Exceptional Conditions Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a handling of exceptional conditions vulnerability in PACTware Consortium’s PACTware application. PACTware Consortium has produced a new service pack that mitigates this vulnerability. Ivan Sanchez has tested the new version to validate that...

Siemens Climatix BACnet/IP Communication Module Cross-site Scripting Vulnerability

OVERVIEW Siemens has identified a cross-site scripting XSS vulnerability in its Climatix BACnet/IP communication module. This vulnerability was reported directly to Siemens by Juan Francisco Bolivar Hernandez. Siemens has produced a new firmware update to mitigate this vulnerability. This...

Hospira Symbiq Infusion System Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 23, 2015, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Billy Rios identified a vulnerability in Hospira’s Symbiq Infusion System, which can be exploited to remotely control th...

Schneider Electric Wonderware System Platform Vulnerabilities

OVERVIEW Ivan Sanchez of WiseSecurity Team has identified a fixed search path vulnerability in Schneider Electric’s Wonderware InTouch, Application Server, Historian, and SuiteLink applications, which are part of the Wonderware System Platform suite. Schneider Electric has produced a patch that...

Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-15-169-01A Wind River VxWorks TCP Predictability Vulnerability in ICS Devices that was published November 5, 2015, on the NCCIC/ICS-CERT web site. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a...

Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability

OVERVIEW Ashish Kamble of Qualys Security and Eireann Leverett have identified authentication, denial of service, and cross-site scripting vulnerabilities in GarrettCom’s Magnum 6k and Magnum 10k product lines. GarrettCom has produced new firmware versions to mitigate these vulnerabilities. Ashis...

RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-162-01 RLE Nova‑Wind Turbine HMI Unsecure Credentials Vulnerability that was published June 11, 2015, on the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified an unsecure credential...

Hospira Plum A+ and Symbiq Infusion Systems Vulnerabilities

OVERVIEW Independent researcher Billy Rios has identified vulnerabilities in Hospira’s Plum A+ Infusion System that are similar to vulnerabilities identified in Hospira’s LifeCare PCA Infusion System discussed in advisory, ICSA-15-125-01B Hospira LifeCare PCA Infusion System Vulnerabilities...

N-Tron 702W Hard-Coded SSH and HTTPS Encryption Keys (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-160-01 N-Tron 702W Hard-Coded SSH and HTTPS Encryption Keys that was published June 9, 2015, on the NCCIC/ICS-CERT web site. Independent researcher Neil Smith has identified hard-coded SSH and HTTPS encryption...

Sinapsi eSolar Light Plaintext Passwords Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified plain text passwords in Sinapsi’s eSolar Light application. Sinapsi has produced a new version to mitigate this vulnerability. AFFECTED PRODUCTS The following Sinapsi eSolar Light versions are affected: Sinapsi eSolar Light firmware versio...

XZERES 442SR Wind Turbine CSRF Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified a cross-site request forgery CSRF vulnerability in XZERES’s 442SR turbine generator operating system OS. XZERES has produced a patch to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The...

Network Time Protocol Vulnerabilities (Supplement Update A)

OVERVIEW --------- Begin Update A Part 1 of 2 -------- This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-353-01C Network Time Protocol Vulnerabilities that was published February 5, 2015, on the ICS‑CERT web site. --------- End Update A Part 1 of 2 ----------...

Network Time Protocol Vulnerabilities (Supplement)

OVERVIEW This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-353-01 Network Time Protocol Vulnerabilities that was published December 19, 2014, on the ICS‑CERT web site. Please refer to the original advisory for all the details of the vulnerabilities. The purpose o...

Moxa SoftCMS Buffer Overflow Vulnerability

OVERVIEW NCCIC/ICS-CERT received a report from HP’s Zero Day Initiative ZDI concerning a buffer overflow vulnerability in Moxa’s SoftCMS software package. This vulnerability was reported to ZDI by security researcher Ariele Caltabiano. Moxa has produced a new version that mitigates this...

Beckwith Electric TCP Initial Sequence Vulnerability

OVERVIEW Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a research project partially sponsored by the Georgia Tech National Electric Energy Testing Research and Applications Center, have identified a TCP initial sequence numbers vulnerability in two of Beckwith Electric’s...

IDS RTU 850 Directory Traversal Vulnerability

OVERVIEW Independent researchers Benjamin Kahler and Sebastian Kraemer of HSASec have identified a directory traversal vulnerability in IDS RTU 850C. IDS has produced a new module that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following ID...

Mitsubishi Electric MELSEC FX-Series Controllers Denial of Service

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on May 26, 2015, and is being released to the NCCIC/ICS-CERT web site. Ralf Spenneberg of OpenSource Security has identified a denial of service DoS vulnerability in the Mitsubishi Electric Automation, Inc.,...

Schneider Electric OFS Server Vulnerability (Update A)

OVERVIEW --------- Begin Update A Part 1 of 4 -------- This updated advisory is a follow-up to the original advisory titled ICSA-15-141-01 Schneider Electric OFS Server Vulnerability that was published May 21, 2015, on the NCCIC/ICS-CERT web site. Ivan Sanchez from Nullcode Team has identified tw...

Rockwell Automation RSView32 Weak Encryption Algorithm on Passwords

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on May 12, 2015, and is being released to the NCCIC/ICS-CERT web site. Rockwell Automation has produced a patch to mitigate a password encryption vulnerability in RSView32. Information Security Analysts Vladimir...

Hospira LifeCare PCA Infusion System Vulnerabilities

OVERVIEW OSIsoft has identified and reported to NCCIC/ICS-CERT a default permissions vulnerability in PI AF product. OSIsoft has produced a mitigation plan to remove this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS OSIsoft reports that the vulnerability affect...

Hospira LifeCare PCA Infusion System Vulnerabilities

OVERVIEW Independent researcher Billy Rios has identified an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in Hospira’s LifeCare PCA Infusion System, which NCCIC/ICS-CERT has been coordinating with Hospira since May 2014. This advisory is...

Hospira LifeCare PCA Infusion System Vulnerabilities

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-15-125-01A Hospira LifeCare PCA Infusion System Vulnerabilities that was published May 13, 2015, on the NCCIC/ICS-CERT web site. --------- Begin Update B Part 1 of 9 -------- Independent researcher Billy Rios has...

Opto 22 Multiple Product Vulnerabilities

OVERVIEW Ivan Sanchez from Nullcode Team has identified two buffer overflow vulnerabilities that are present in Opto 22’s PAC Project Professional, PAC Project Basic, OptoOPCServer, OptoDataLink, PAC Display Basic, and PAC Display Professional products. Opto 22 has released new versions that...