Bulletins | CERT@VDE

1
2
3 (current)

Dienstag, 10.01.2023

SSA-552702 V1.3 (Last Update: 2023-01-10): Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Pr...

Titel

SSA-552702 V1.3 (Last Update: 2023-01-10): Privilege Escalation Vulnerability in the Web Interface of SCALANCE and RUGGEDCOM Products

Veröffentlicht

10. Januar 2023 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-552702.pdf

Text

The products listed below do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific ...

01:00

SIEMENS CERT

SSA-592007 V1.9 (Last Update: 2023-01-10): Denial of Service Vulnerability in Industrial Products

Titel

SSA-592007 V1.9 (Last Update: 2023-01-10): Denial of Service Vulnerability in Industrial Products

Veröffentlicht

10. Januar 2023 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-592007.pdf

Text

Several industrial controllers are affected by a security vulnerability that could allow an attacker to cause a denial of service condition via PROFINET DCP network packets under certain circumstances. Precondition for this scenario is a direct OSI Layer 2 access to the affected products. PROFIBUS interfaces are not affected. Siemens ...

01:00

SIEMENS CERT

SSA-593272 V1.9 (Last Update: 2023-01-10): SegmentSmack in Interniche IP-Stack based Industrial Devices

Titel

SSA-593272 V1.9 (Last Update: 2023-01-10): SegmentSmack in Interniche IP-Stack based Industrial Devices

Veröffentlicht

10. Januar 2023 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-593272.pdf

Text

A vulnerability exists in affected products that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released updates for several ...

01:00

SIEMENS CERT

SSA-697140 V1.1 (Last Update: 2023-01-10): Denial of Service Vulnerability in the TCP Event Service of SCALANCE and RUGGEDCOM P...

Titel

SSA-697140 V1.1 (Last Update: 2023-01-10): Denial of Service Vulnerability in the TCP Event Service of SCALANCE and RUGGEDCOM Products

Veröffentlicht

10. Januar 2023 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-697140.pdf

Text

The products listed below contain a denial of service vulnerability in the TCP event interface that could allow an unauthenticated remote attacker to render the device unusable. Siemens has released updates for the affected products and recommends to update to the latest versions.

01:00

SIEMENS CERT

SSA-710008 V1.2 (Last Update: 2023-01-10): Multiple Web Vulnerabilities in SCALANCE Products

Titel

SSA-710008 V1.2 (Last Update: 2023-01-10): Multiple Web Vulnerabilities in SCALANCE Products

Veröffentlicht

10. Januar 2023 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-710008.pdf

Text

SCALANCE devices contain multiple vulnerabilities in MSPS based product lines that could allow authenticated remote attackers to execute custom code or create a XSS situation, as well as unauthenticated remote attackers to create a denial of service condition. Siemens has released updates for several affected products and recommends to update ...

01:00

SIEMENS CERT

SSA-712929 V1.6 (Last Update: 2023-01-10): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Prod...

Titel

SSA-712929 V1.6 (Last Update: 2023-01-10): Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products

Veröffentlicht

10. Januar 2023 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf

Text

A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL. Siemens has released updates for several affected products and recommends to update to the latest ...

01:00

SIEMENS CERT

SSA-936212 V1.0: JT File Parsing Vulnerabilities in JT Open, JT Utilities and Solid Edge

Titel

SSA-936212 V1.0: JT File Parsing Vulnerabilities in JT Open, JT Utilities and Solid Edge

Veröffentlicht

10. Januar 2023 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf

Text

JT Open Toolkit, JT Utilities and Solid Edge are affected by memory corruption vulnerabilities that could be triggered while parsing JT files. If a user is tricked to open a malicious JT file with any of the affected products, this could cause the application to crash or potentially lead to ...

Donnerstag, 05.01.2023

16:20

US CERT (ICS)

Hitachi Energy UNEM

Titel

Hitachi Energy UNEM

Veröffentlicht

5. Januar 2023 16:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-23-005-01

Text

16:05