CISA releases 6 Industrial Control Systems Advisories
Cybersecurity and Infrastructure Security Agency sent this bulletin at 11/18/2021 12:27 PM EST
You are subscribed to no topic for Cybersecurity and Infrastructure Security Agency. This information has recently been updated, and is now available.
This advisory contains mitigations for Use of Hard-coded Credentials, and Authentication Bypass Using an Alternate Path or Channel vulnerabilities in Philips IntelliBridge EC 40 and EC 80 Hub medical device interfacing modules.
This advisory contains mitigations for Improper Input Validation, Use of Hard-coded Cryptographic Key, and Use of a Broken or Risky Cryptographic Algorithm vulnerabilities in Philips Patient Information Center iX (PIC iX) and Efficia CM Series products.
The updated advisory is a follow-up to the original advisory titled ICSA-21-266-01 Trane Symbio that was published on September 23, 2021, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for a Code Injection vulnerability in Trane Symbio 700 and Symbio 800 controllers.
This updated advisory is a follow-up to the advisory update titled ICSMA-20-254-01 Philips Patient Monitoring Devices (Update A) that was published August 31, 2020, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for Improper Neutralization of Formula Elements in a CSV File, Cross-site Scripting, Improper Authentication, Improper Check for Certificate Revocation, Improper Handling of Length Parameter Inconsistency, Improper Validation of Syntactic Correctness of Input, Improper Input Validation, and Exposure of Resource to Wrong Sphere vulnerabilities in Philips patient monitoring devices.
This updated advisory is a follow-up to the advisory update titled ICSA-20-212-04 Mitsubishi Electric Factory Automation Engineering Products (Update D) that was published July 27, 2021, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for an Unquoted Search Path or Element vulnerability in Mitsubishi Electric Factory Automation Engineering products.
This updated advisory is a follow-up to the advisory update titled ICSA-20-084-01 VISAM Automation Base (VBASE) (Update A) that was published July 8, 2021, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for Relative Path Traversal, Incorrect Default Permissions, Inadequate Encryption Strength, Insecure Storage of Sensitive Information, and Stack-based Buffer Overflow vulnerabilities in VISAM VBASE automation platform.