High ICSA-22-111-03 9 CVEs

Hitachi Energy MicroSCADA Pro/X SYS600

Published Apr 21, 2022 · Updated Apr 21, 2022

Vendor: Hitachi Energy Product: SYS600

Summary

Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.

Vulnerabilities 9

Low 3.7

CVE-2020-1968

Raccoon attack

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker bein…

OpenSSL OpenSSL openssl openssl Debian Ubuntu

Sep 9, 2020
Unscored —

CVE-2020-8172

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

nodejs nodejs-current Alpine

Jun 8, 2020
Unscored —

CVE-2020-8174

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

nodejs nodejs nodejs nodejs-current Debian Ubuntu Alpine

Jul 24, 2020
Unscored —

CVE-2020-8201

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspe…

Node.js node nodejs nodejs Debian Alpine

Sep 18, 2020
Unscored —

CVE-2020-8252

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined t…

Node.js node nodejs libuv1 Debian Ubuntu Alpine

Sep 18, 2020
Unscored —

CVE-2020-8265

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Jan 6, 2021
Unscored —

CVE-2020-8287 Public exploit EPSS 16%

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…

Node.js node nodejs nodejs Debian Ubuntu Alpine

Jan 6, 2021
Unscored —

CVE-2021-32027

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine

Jun 1, 2021
Unscored —

CVE-2021-32028

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an au…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine

Oct 11, 2021

Revision history

2022-04-21 #1
ICSA-22-111-03 Hitachi Energy MicroSCADA ProX SYS600

References

ICS Advisory ICSA-22-111-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-111-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B