# MA-899.122022: MyCERT Advisory - CISA Releases Three Industrial Control Systems Advisories

**Date:** 15 Dec 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-899.122022  
**Advisory ID:** MA-899.122022

---

**1.0 Introduction**
Recently, CISA has released three (3) Industrial Control Systems (ICS) advisories on December 13, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.
**2.0 Impact**
Successful exploitation of these vulnerabilities could allow an attacker to write arbitrary files, unauthenticated remote code execution, unauthenticated password changes, escalation of privileges, or allow a remote attacker to send specially crafted requests.
**3.0 Affected Products**
- ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI versions v10.96 to v10.97.2 (Note: ICONICS version 10.97.2 CFR1 and later versions are not vulnerable to this vulnerability)
- APC Easy UPS Online Version 2.5-GA and prior (Windows 7, 10, 11, Windows Server 2016, 2019, 2022)
- APC Easy UPS Online Version 2.5-GA-01-22261 and prior (Windows 11, Windows Server 2019, 2022)
- CONPROSYS HMI System (CHS): Version 3.4.4 and prior
**4.0 Recommendations**
MyCERT encourages users and administrators to review the newly released ICS advisories for technical details and mitigations:
•    ICSA-22-347-01 [ICONICS and Mitsubishi Electric Products](https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01) : <https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01>
•    ICSA-22-347-02 [Schneider Electric APC Easy UPS Online](https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-02) : <https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-02>
•    ICSA-22-347-03 [Contec CONPROSSYS HMI System (CHS)](https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-03) : <https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-03>
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please get in touch with MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/uscert/ncas/current-activity/2022/12/13/cisa-releases-three-industrial-control-systems-advisories>