The Internet Systems Consortium (ISC) released security advisories due to vulnerabilities found in Berkeley Internet Name Domain (BIND) 9.

Sources: ISC Advisory, CISA

Measuresoft ScadaPro Server contains an improper access control vulnerability that could lead to modification of the service binary path and start malicious commands with SYSTEM privileges.

Sources: CISA

Multiple Mitsubishi Electric products contain predictable exact value from previous values vulnerabilities that could lead to remote command execution.

Sources: Mitsubishi Electric Support, CISA

Multiple factory automation engineering software products from Mitsubishi Electric contain a permissions issues vulnerability that could lead to the reading of arbitrary files, cause a denial-of-service condition or allow execution of a malicious binary.

Sources: Mitsubishi Electric Advisory, CISA

CISA and the NSA released a joint cybersecurity advisory (CSA) about control system defense for operational technology (OT) and industrial control systems (ICSs).

Sources: Joint CSA, CISA

CISA and the FBI released a joint cybersecurity advisory (CSA) that indicates Iranian state cyber actors' techniques and operations.

Sources: Joint CSA, CISA

Mozilla released security updates in Firefox, Firefox ESR and Thunderbird due to vulnerabilities found that could lead to an attacker gaining control of affected systems.

Sources: Firefox Advisory, CISA, Firefox ESR Advisory, Thunderbird Advisory

Microsoft released a security update for Microsoft Endpoint Configuration Manager due to vulnerabilities found that could lead to an attacker gaining sensitive information.

Sources: Microsoft Vulnerability, CISA

Medtronic MiniMed 600 Series Insulin Pumps contain a protection mechanism failure vulnerability that could lead to delivering too much or too little insulin through delivery of an unintended insulin bolus or because insulin delivery is slowed or stopped.

Sources: CISA

Hitachi Energy PROMOD IV contains an improper access control vulnerability that could lead to an attacker deleting arbitrary files on affected systems.

Sources: Hitachi Energy Advisory, CISA

Hitachi Energy AFF660/665 Firewall contains a stack-based buffer overflow vulnerability that could lead to fully compromising a device.

Sources: Hitachi Energy’s Advisory, CISA

Dataprobe iBoot-PDU FW contains OS command injection, path traversal, exposure of sensitive information to an unauthorized actor, improper access control, improper authorization, incorrect authorization and SSRF vulnerabilities that could lead to unauthenticated remote code execution.

Sources: iBoot-PDU FW Support, CISA

Host Engineering H0-ECOM100 Communications Module contains a stack-based buffer overflow vulnerability that could lead to a denial-of-service condition.

Sources: Host Engineering Website, CISA

AutomationDirect DirectLOGIC with Ethernet Communication Modules contains uncontrolled resource consumption and cleartext transmission of sensitive information vulnerabilities that could lead to a loss of sensitive information, unauthorized changes and a denial-of-service condition.

Sources: AutomationDirect Security Advisory, CISA

AutomationDirect DirectLOGIC with Serial Communication contains a cleartext transmission of sensitive information vulnerability that could lead to a loss of sensitive information and unauthorized changes.

Sources: AutomationDirect Security Advisory, CISA

MiCODUS MV720 GPS tracker contains use of hard-coded credentials, improper authentication, cross-site scripting and authorization bypass through user-controlled key vulnerabilities that could lead to an attacker having control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands and the disarming of various features.

Sources: MiCODUS Update, CISA