ICS Advisories

Risk evaluation

Multiple W&T devices are shipped with a jQuery version with a known XSS vulnerability.

Mitigatiesamenvatting

Access to the WBM should be limited to trustworthy networks or peers.

Risk evaluation

Multiple W&T Products are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via crafted payloads injected into several input fields of the configuration webpage.

Mitigatiesamenvatting

Access to the WBM should be limited to trustworthy networks or peers.

Risk evaluation

Com-Server firmware versions prior to 1.60 support the insecure TLS 1.0 and TLS 1.1 protocols, which are susceptible to man-in-the-middle attacks and thereby compromise the confidentiality and integrity of data.

Mitigatiesamenvatting

Access to the WBM should be limited to trustworthy networks or peers.

Risk evaluation

The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens".

Mitigatiesamenvatting

Customers should configure a perimeter firewall to block traffic from untrusted networks and users to the device. These recommendations will be incorporated into the device documentation (operating instructions). Change default password for operator, service and admin account. Endress+Hauser will not change this behavior. Customers are recommended to take the measures for Temporary Fix / Mitigation as described above.

Risk evaluation

Beckhoff's TwinCAT 3.1 Build 4026 software is modularized and is installed with different packages depending on user requirements. These packages are selected and installed using either the command line utility tcpkg or the corresponding graphical user interface called TwinCAT Package Manager. Both use the same configuration that specifies where to load packages from. These locations are called feeds, have preconfigured default settings and can be customized by administrative users, for example to add another local mirror of a package server. When using the TwinCAT Package Manager on a PC, a user with administrative access rights can locally set a specially crafted URL for a feed that causes the TwinCAT Package Manager to execute arbitrary operating system commands.

Mitigatiesamenvatting

Administrative users shall always act thoroughly and inspect the values which they enter.

Risk evaluation

Multiple Pilz products are affected by stored cross-site-scripting (XSS) vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system. Update: 27.02.2024 Fix typo in advisory title

Mitigatiesamenvatting

* Only use project files from trustworthy sources. * Protect project files against modification by unauthorized users. * PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar measures. Use password protection on the online project.

Risk evaluation

TruControl laser control software prior to version 1.60.0 uses an OpenSSH server version affected by CVE-2024-6387. The affected OpenSSH Server version could potentially lead to a remote code execution.

Mitigatiesamenvatting

Update to first fixed version 1.06.00 or ideally to the newest release 04.04.00

Risk evaluation

TruControl laser control software from versions 3.50.0 to 4.00.0.B use Linux kernel versions affected by CVE-2024-1086. The affected kernel vulnerability could lead to local privilege escalation.

Mitigatiesamenvatting

• Update to the new release 4.04.0 of the TruControl software version

Risk evaluation

The Fraunhofer Institute discovered a vulnerability in the Profinet IO Coupler 0750-0375 during fuzzing tests. These tests revealed weaknesses in the validation and processing of incoming data packets across various protocols and services.

Mitigatiesamenvatting

Update to firmware version 02.10.01 (12).

Risk evaluation

The following tools: * VisiWinNET Smart * VisiWinNET Professional * EASY UI Designer create a directory with insufficient permissions, allowing a low-level user the ability to add and modify certain files that hold SYSTEM privileges, which could lead to privilege escalation.

Mitigatiesamenvatting

Only use this tool in a protected and controlled environment to minimize network impact and to ensure that the tool is inaccessable from outside. In addition, the use of firewalls is recommended to reduce the attack surface, specially to the internet and the internal business network.

Risk evaluation

Several vulnerabilities in the Endress+Hauser MEAC300-FNADE4 were discovered, that can be accessed via Ethernet.

Mitigatiesamenvatting

Customers are strongly advised to update to the newest version.

Risk evaluation

Multiple Weidmueller products are affected by an OpenSSL vulnerability. Weidmüller has released new firmwares of the affected products to fix the vulnerability.

Mitigatiesamenvatting

Update to version V3.6.30

Risk evaluation

Nozomi Networks reported a vulnerability in the pfc firmware sdk-G2 of libwagosnmp. The WAGO pfc-firmware-sdk-G2 is a software development kit designed for WAGO PFC devices which developers to build and customize the firmware.

Mitigatiesamenvatting

Update to Firmware 04.07.01 (FW29) or Firmware 03.10.11 (FW22 Patch 2). For the latest Custom Firmware, please contact the WAGO support.

Risk evaluation

Several WAGO Firmwares are vulnerable, due to an incorrect calculation of the buffer size in the CODESYS OPC UA STACK. This can lead to a crash of the runtime of the following firmware versions installed on several devices.

Mitigatiesamenvatting

The incorrect calculation of the buffer size can be avoided if the maximum supported array length of the OPC UA stack of the CODESYS Control runtime system is limited to a value of 10129639 (Stack.MaxArrayLenth=10129639) or less. This can be achieved by adding the following setting in the runtime configuration under the following path: /etc/codesys3.d/codesyscotrol.cfg

Risk evaluation

An unauthenticated attacker would be able to send crafted requests to cause the CODESYS Gateway Server V2 to allocate excessive memory or consume all available TCP client connections. Besides, passwords are insufficiently checked during login. All versions of the following CODESYS V2 product prior version V2.3.9.38 are affected: • CODESYS Gateway Server

Mitigatiesamenvatting

Enable password protection at login in case no password is set at the controller. Please note that the password configuration file is not covered by the default FFT backup and restore mechanism. You must select the related file manually.

Risk evaluation

Echo Curve Viewer is an utility used for offline visualization of previously recorded envelope curve data. Envelope curve records are exported from other Endress+Hauser software products like FieldCare as .curves files. Echo Curve Viewer opens .curves files and displays their contents. The .curves files contain device- specific C# calculation scripts as .cs files, that are needed for the interpretation of certain curve record types. Echo Curve Viewer loads .curves files and executes the contained C# code.

Mitigatiesamenvatting

- For standalone Echo Curve Viewer installations, download and install Echo Curve Viewer version >=6.00.00 from the Endress+Hauser Software Portal - For bundled installations with FieldCare SFE500, download and install FieldCare SFE500 Package version >= 1.40.1 from the Endress+Hauser Software Portal external link - For Field Xpert Devices, the required update is installed automatically during startup. This requires a working internet connection and (under certain circumstances) a valid maintenance period and/or a connection to the E+H Netilion Cloud. Please refer to the Field Xpert documentation for details regarding the update mechanism.

Risk evaluation

Products from the Edge Gateway Family are affected by recently published so called RegreSSHion vulnerability.

Mitigatiesamenvatting

Disable SSH Access via CLI Command or Config Import locally or for a centrally managed device by changing the configuration in SMART EMSRefer to eG OS manual chapter 4.26 for further information

Risk evaluation

There exists a vulnerability in all REX 100 devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30pm  In section Reported by Sebastian Dietz (CyberDanube) was added.

Mitigatiesamenvatting

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Risk evaluation

There exists a vulnerability in all mbNET.mini devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests. Update: 03.07.2024 3:30 pm  In section Reported by Sebastian Dietz (CyberDanube) was added.

Mitigatiesamenvatting

As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.

Risk evaluation

Welotec has been informed by an external source that the WebUI of the device management solution "SMART EMS" and the remote connectivity solution "VPN Security Suite" is vulnerable to so-called "Clickjacking" and advises to update to version v3.1.4 or later.

Mitigatiesamenvatting

This vulnerability can be mitigated with the use of an additional Reverse Proxy and / or Web Application Firewall protecting the WebUI.

Risk evaluation

The PITreader product family is using the 3rd -party-component uC/HTTP to implement the web server functionality. uC/HTTP is affected by multiple vulnerabilities. These vulnerabilities may enable an attacker to gain full control over the system.

Mitigatiesamenvatting

Install the fixed firmware version. Please visit the Pilz Website to download the latest firmware update. Instructions about installing the firmware update can be found in the user manual. Limit network access to legitimate connections by using a firewall or similar measures.

Risk evaluation

The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60d) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes these vulnerabilities is available.

Mitigatiesamenvatting

CVE-2023-38545 only appears when used together with a SOCKS-5 Proxy. Not using theaffected products via a SOCKS-5 proxy mitigates the vulnerability.

Risk evaluation

Multiple vulnerabilities in the included versions of OpenSSL can lead to different problems, including crashes of the OpenSSL modules (leading to a Denial of Service) or leakage of plaintext. These underlying vulnerabilities can be fixed by installing a software update provided by TRUMPF.

Mitigatiesamenvatting

Please contact your TRUMPF Service with the PR number 500876.

Risk evaluation

The Builder and Viewer components of the product PASvisu are based on the 3rd-party-component Electron. Electron contains several other open-source components which are affected by vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system. The vulnerabilities can be exploited locally or over the network.

Mitigatiesamenvatting

Install the fixed product version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version. Only use project files from trustworthy sources. Protect project files against modification by unauthorized users. Limit network access to legitimate connections by using a firewall or similar measures. Usepassword protection on the online project.

Risk evaluation

The TRUMPF CAD/CAM software tools mentioned above use the vulnerable CodeMeter Runtime (up to version 7.60b) application from WIBU-SYSTEMS AG to manage licenses within the component TRUMPF License Expert. This CodeMeter application contains new vulnerabilities, which may enable an attacker to gain full access to the server or workstation on which the TRUMPF License Expert has been installed on. A new version of the TRUMPF License Expert which fixes this vulnerability is available.Machines with a running and correctly installed mGuard hardware firewall cannot be exploited by this vulnerability if used as intended (according to the manual). Update A, 2023-11-13 Removed CVE-2023-4701 because it was revoked.

Mitigatiesamenvatting

Implement general security best practices like network segmentation, endpoint protection and system hardening. Restrict network access to the TRUMPF License Expert server component to required clients only by using firewalls or other suitable products.