安全公告

Fixed in UaGateway 1.5.13
CVE-2022-4304 – OpenSSL library
CVE-2023-0286 – OpenSSL library
ZDI-CAN-20353 – Certificate Parsing Integer Overflow Denial-of-Service
ZDI-CAN-20494 – Improper Input Validation Denial-of-Service
ZDI-CAN-20495 – Null Pointer Dereference Denial-of-Service
ZDI-CAN-20497 – Use-After-Free Denial-of-Service

Fixed in UaGateway version 1.5.14
ZDI-CAN-20497 – Use-After-Free Denial-of-Service
ZDI-CAN-20576 – AddServer XML Injection Denial-of-Service
ZDI-CAN-20577 – NodeManagerOpcUa Use-After-Free Remote Code Execution

UaGateway versions prior to 1.5.14

Refer to Unified Automation Security Bulletins and UaGateway Changelog for more details.

SB2022-7

Completed

2023年01月23日

A vulnerability affects the configuration of SMS & Email Accounts.

CVE Id: CVE-2022-4312

Fixed in PcVue 12.0.28 and PcVue 15.2.4

All versions since PcVue 8.10

2022-7

SB2022-6

Completed

2022年12月20日

A Denial of Service vulnerability affects the IEC 61850 client driver and the ICCP/TASE.2 interface.

CVE Id: CVE-2022-38138

Fixed in PcVue 12.0.28 and PcVue 15.2.3

PcVue 15

2022-6

SB2022-5

Completed

2023年01月23日

A Denial of Service vulnerability affects the IEC 61850 client driver and the ICCP/TASE.2 interface.

CVE Id: CVE-2022-38138

Fixed in PcVue 12.0.28 and PcVue 15.2.3

IEC 61850 : PcVue 10.0 onward
ICCP/TASE.2 : PcVue 15.1

2022-5

SB2022-4

Completed

2022年09月19日

A vulnerability affects the configuration of the OAuth web service.

CVE Id: CVE-2022-2569

Fixed in PcVue 12.0.27 and PcVue 15.2.3

PcVue 15
PcVue 12

2022-4

SB2022-3

Completed

2022年01月07日

During the Miami Pwn2Own contest the Zero Days Initiative (ZDI) reported multiple vulnerabilities.

CVE Id: CVE-2022-29862, CVE-2022-29864

Fixed in UaGateway version 1.5.10

UaGateway versions prior to 1.5.10

Refer to Unified Automation Security Bulletins for more details.

SB2022-2

Completed

2022年07月05日

CVE-2021-45117 – OPC Foundation, autogenerated ANSI C Stack Stubs
CVE-2022-0778 – OpenSSL library
Fixed in UaGateway version 1.5.9

UaGateway versions prior to 1.5.9

Refer to Unified Automation Security Bulletins for more details.

SB2022-1

Completed

2022年02月28日

Ocean Data Systems Dream Report privilege escalation vulnerabilities.

Dream Report 5 : CVE-2020-13532, CVE-2020-13533, CVE-2020-13534
Dream Report 2020 : CVE-2021-21957

Fixed in Dream Report 2020 R2 SP1

Dream Report

SB2021-1

Completed

2021年12月16日

Timeline and concerns related to the Apache Log4j vulnerability
CVE-2021-44228, CVE-2021-45046

2021-1

SB2020-1

Completed

2021年08月02日

3 vulnerabilities affect the interface between the Web & Mobile back end and the web services hosted in Microsoft IIS

CVE-2020-26867, CVE-2020-26868, CVE-2020-26869

PcVue 8.10 and later

2020-1

SB2018-1

Completed

2018年01月22日

ICS-ALERT-18-011-01B: Timeline and concerns related to the Microsoft Windows updates designed to mitigate the Meltdown & Spectre vulnerabilities

PcVue
FrontVue
PlantVue
Partner products

2018-1

SB2012-2

Completed

2012年08月30日

ICSA-12-024-01: Ocean Data Systems Dream Reports XSS and write access violation vunlerabilities.

CVE-2011-4038, CVE-2011-4039

Dream Report versions prior to 4.0

SB2012-1

Completed

2014年11月21日

ActiveBar, a 3rd party component used in our products is subject to an alert: ICS-ALERT-11-271-01
More information is available at Microsoft KB2562937
Microsoft released a Windows security update addressing this issue in August 2011.

PcVue 6.0 and later
FrontVue – All versions
PlantVue – All versions

2012-1

SB2011‑1

Completed

2014年11月21日

ICS-ALERT-11-271-01: PcVue HMI/SCADA multiple ActiveX Vulnerabilities
CVE-2011-4042, CVE-2011-4043, CVE-2011-4044, CVE-2011-4045

PcVue 6.0 and later
FrontVue – All versions
PlantVue – All versions

2011-1