ICS Advisories

Risk evaluation

In case TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending special packets to the device.

Mitigatiesamenvatting

Profinet could be blocked in perimeter firewall to block PROFINET DCP packets from untrusted networks to the device. Beckhoff will provide updates for the mentioned TwinCAT Versions.

Risk evaluation

Two vulnerabilites have been discovered in mbCONNECT24 and mbCONNECT24 in all versions through 2.13.3.

Mitigatiesamenvatting

If you have MFA enabled on the admin user, the password will still be set, but the attacker will be unable to login as the MFA is still in place.

Risk evaluation

An issue was discovered in myREX24 and myREX24.virtual in all versions through 2.11.2.

Mitigatiesamenvatting

Update to Version 2.12.1

Risk evaluation

An issue was discovered in the myREX24 and myREX24-virtual software in all versions through V2.9.0.

Mitigatiesamenvatting

Update myREX24/myREX24-virtual to 2.10.1

Risk evaluation

The data24 service that is bundled with every installation of myREX24 V2/myREX24.virtual has two serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity and availability.

Mitigatiesamenvatting

Update to latest version: 2.16.2 CVE-2024-23943: This fix does not apply to REX 200/REX 250 devices with firmware 8.0.0 - 8.1.3. If you are using a device with this firmware, please update it to >= 8.2.0.

Risk evaluation

Multiple Wiesemann & Theis product families are affected by a vulnerability in the web interface. The device allows an unauthenticated attacker to get the session ID of a logged in user. He may then spoof his IP address to act as the logged in user.

Mitigatiesamenvatting

Update Com-Server family to version 1.55 Update Com-Server Highspeed family to version 1.78 or higher

Risk evaluation

Critical vulnerability has been discovered in the utilized component Ethernet IP Stack by Hilscher Gesellschaft für Systemautomation mbH. The impact of the vulnerability on the affected device is that it can denial of service remote code execution code exposure For more information see advisory by Hilscher: https://kb.hilscher.com/pages/viewpage.action?pageId=108969480

Mitigatiesamenvatting

An external protective measure is required. Minimize network exposure for affected products and ensure that they are not accessible via the Internet. Isolate affected products from the corporate network. If remote access is required, use secure methods such as virtual private networks (VPNs).

Risk evaluation

A number of TRUMPF CAD/CAM software tools use the CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to prevent normal operation of CodeMeter, resulting in a Denial-of-Service and potentially execute arbitrary code.

Mitigatiesamenvatting

- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.

Risk evaluation

Multiple Wiesemann & Theis software products are affected by a vulnerability through an unquoted search path in the Windows registry. A local attacker can execute arbitrary code and gain administrative privileges by inserting an executable file in the path of the affected product. Update A, 07.03.2024 Incorrect version numbers have been corrected.

Mitigatiesamenvatting

- Update Com Redirector Legacy external link to version 3.94 or higher (Art.No. 00102) - Update Com Redirector PnP external link to version 4.43 or higher (Art.No. 00111) - Update OPC-Server external link to version 4.89 or higher (Art.No. 00103)

Risk evaluation

Welotec has closed two vulnerabilities in the TK500v1 router series and advises to update the routers to firmware version r5542 or later. An exploitation of the vulnerabilities can allow an attacker to manipulate the device.

Mitigatiesamenvatting

Update the product to firmware v2.3.0.r5542 or later.

Risk evaluation

A number of Pilz software tools use the Software CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to change and falsify a licence file, prevent normal operation of Code- Meter (Denial-of-Service) and potentially execute arbitrary code.

Mitigatiesamenvatting

Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.

Risk evaluation

An attacker may gain access (by elevated privileges) to CT50-Ex mobile computers through a vulnerability in a system service running the Android Operating System (OS). The system service improperly validates incoming connection requests. Although the vulnerability is significant, currently no known exploits publicly available.

Mitigatiesamenvatting

An update is available that resolves this vulnerability. All customers using the impacted products should update their products as indicated in the chart below. Only products listed below are affected by this vulnerability. Updates are available via the Pepperl+Fuchs / ecom product support channel or directly from the original manufacturer Honeywell at https://hsmftp.honeywell.com . Pepperl+Fuchs strongly recommends that users upgrade to the version identified below to resolve the vulnerability. CT50-Ex, Android 6.0, Update to CommonES 4.01.00.4134 or later CT50-Ex, Android 6.0, Update ECP to version 2.30.00.0167 or later (if applicable) CT50-Ex, Android 4.4, Update to CommonES 3.17.3445 or later For support, please contact your local Pepperl+Fuchs sales representative.

Risk evaluation

A vulnerability in the use of hard-coded Platform Keys (PK) within the UEFI framework, known as PKfail, has been discovered in several Pepperl+Fuchs devices.

Mitigatiesamenvatting

Protect the device from unauthorized physical access.

Risk evaluation

A vulnerability has been discovered in the fdtCONTAINER component and application by M&M Software GmbH. As this software is part of the Weidmüller FDT/DTM Software with WI Manager, this Weidmueller software is affected by the above vulnerability as well. The fdtCONTAINER component exchanges binary data blobs with the WI Manager. The WI Manager saves these binary data blobs into a project file. If an attacker gets write access to the project file, the project file can be manipulated to contain malicious code.

Mitigatiesamenvatting

- Exchange project data only via secure exchange services - Use appropriate means to protect the project storage from unauthorized manipulation - Do not open project data from an unknown source - Reduce the user rights of the WI Manager to the necessary minimum

Risk evaluation

A network port intended only for device-internal usage is accidentally accessible via external network interfaces.

Mitigatiesamenvatting

Restrict access to the network th device is connected to Do not directly connect the device to the internet

Risk evaluation

WIBU-SYSTEMS report multiple vulnerabilities in their CodeMeter Runtime software. As part of the Weidmüller u-create studio installation the WIBU-SYSTEMS CodeMeter is installed by default. As the u-create studio installation bundle contains vulnerable versions of WIBU-SYSTEMS CodeMeter, the u-create studio is affected by a subset of these vulnerabilities. For details refer to section "Impact".

Mitigatiesamenvatting

- Use the updated versions of the TRUMPF CAD/CAM products that will be available via your service channel shortly. - Until then, reduce internet usage on workstations with TRUMPF CAD/CAM products to a minimum.

Risk evaluation

Promass 83 devices utilizing 499ES EtherNet/IP (ENIP) Stack by Real Time Automation (RTA) are vulnerable to a stack-based buffer overflow. Update A, 2021-10-07: added credits changed title from "ENDRESS+HAUSER: Promass 83 with Ether/IP affected by DoS vulnerability" to "ENDRESS+HAUSER: Promass 83 with EtherNet/IP affected by a stack-based buffer overflow"

Mitigatiesamenvatting

If an immediate firmware update is not possible, the only way to prevent an attack is to disable communication via EtherNet/IP.

Risk evaluation

Endress+Hauser products utilizing WPA2 are vulnerable to KRACK attacks. Proline portfolio is a flow meter with an optional WLAN interface in the display. The flowmeters are only affected if the optional WLAN display is present.

Mitigatiesamenvatting

If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.

Risk evaluation

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

Mitigatiesamenvatting

Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1

Risk evaluation

Multiple issues have been identified in dnsmasq < 2.83

Mitigatiesamenvatting

Update to the following versions: | Product | Fixed Version | |--------------------|-------------------| | mbNET/mbNET .rokey | >= 7.0.0 | | mbNET HW1 | >= 5.1.11 |

Risk evaluation

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.9.0.

Mitigatiesamenvatting

Update mbCONNECT24/mymbCONNECT24 to 2.10.1

Risk evaluation

Multiple Vulnerabilities in mbConnect24serv (a software service of mbDIALUP) can lead to arbitrary code execution due to improper privilege management. Update A, 2021-11-24 corrected fixed version in solution from 3.9R0.4 to 3.9R0.5 Update B, 2022-03-28 Updated CVSS score from CVE-2021-33527 from 7.8 to 9.8 due to new information about the vulnerability

Mitigatiesamenvatting

Update to 3.9R0.5

Risk evaluation

Two vulnerabilities in mbCONNECT24 and mymbCONNECT24 can lead to information disclosure and arbitrary code execution. Please consult the CVE entries for details.

Mitigatiesamenvatting

Update to 3.9R0.5

Risk evaluation

Several Helmholz products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".

Mitigatiesamenvatting

Prevent all access to the sshd daemon listening on port 22.

Risk evaluation

A vulnerability in the Wibu CodeMeter Runtime, which is part of the installation packages of several Festo products, was found. An attacker exploiting the vulnerability in WIBU CodeMeter Runtime in server mode could gain full access to the affected server via network access without any user interaction. This could lead to remote code execution and escalation of privileges giving full admin access on the host system for an already authenticated user (logged in locally to the PC).

Mitigatiesamenvatting

Update CodeMeter Runtime to version >= 7.60c The latest version of CodeMeter Runtime can be downloaded from WIBU System's web site.