The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Oct 25, 2018

GEOVAP Reliance 4 SCADA/HMI

Original release date: October 25, 2018
Vulnerability: Cross-site Scripting
4. MITIGATIONS
GEOVAP released Version 4.8.0, which mitigates the vulnerability. GEOVAP strongly recommends users upgrade existing projects to this version. It can be downloaded here:
Click to expand...

guest · Oct 30, 2018

This is how hackers can take down our critical energy systems through the Internet
October 30, 2018
https://www.zdnet.com/article/this-is-how-hackers-can-take-down-our-core-water-energy-systems/

On Tuesday, researchers from Trend Micro published a report on the ways that Human Interface Systems (HMI), which are found in thousands of utilities worldwide, can be exploited.

HMIs are necessary for human operators to be able to interact with supervisory control and data acquisition (SCADA) systems. If an HMI can be successfully compromised, this can potentially lead to the exposure of SCADA systems -- which, in turn, can give attackers access to the heart of industrial operations.

Trend Micro says that most often, these HMIs are accessible through VNC desktop sharing servers and often lack any form of authentication or protection from intrusion.

"While critical infrastructure (CI) cybersecurity awareness is steadily growing and significant steps have been taken to secure CI, its protection could still definitely be better improved," Trend Micro says.
Click to expand...

"Exposed and Vulnerable Critical Infrastructure: Water and Energy Industries" (PDF):
https://documents.trendmicro.com/assets/white_papers/wp-exposed-and-vulnerable-critical-infrastructure-the-water-energy-industries.pdf

ronjor · Oct 30, 2018

PEPPERL+FUCHS CT50-Ex

Original release date: October 30, 2018
Vulnerability: Improper Privilege Management
4. MITIGATIONS
An update is available that resolves this vulnerability. All users of the affected products should update products as follows:
Click to expand...

ronjor · Oct 30, 2018

Vecna VGo Robot (Update A)

Original release date: April 24, 2018 | Last revised: October 30, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-114-01 Vecna VGo Robot that was published April 24, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Oct 30, 2018

Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripting Vulnerability (Update A)

Original release date: March 01, 2016 | Last revised: October 30, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-16-061-02 Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripting Vulnerability that was published March 1, 2016, on the NCCIC/ICS-CERT website.
Click to expand...

guest · Nov 1, 2018

ronjor said: ↑

Honeywell SMX Protects Industrial Sites From USB Threats
Click to expand...

USB Drives Deliver Dangerous Malware to Industrial Facilities: Honeywell
November 01, 2018
https://www.securityweek.com/usb-drives-deliver-dangerous-malware-industrial-facilities-honeywell

Honeywell has analyzed data collected from 50 locations across the United States, South America, Europe and the Middle East. The enterprises whose systems were part of the study represented the energy, oil and gas, chemical manufacturing, pulp and paper, and other sectors.

Honeywell said its product had blocked at least one suspicious file in 44% of the analyzed locations. Of the neutralized threats, 26% could have caused major disruptions to industrial control systems (ICS), including loss of control or loss of view.

Furthermore, Honeywell says 16% of the detected malware samples were specifically designed to target ICS or IoT systems, and 15% of the samples belonged to high profile families such as Mirai (6%), Stuxnet (2%), Triton (2%), and WannaCry (1%).

“These findings are worrisome for several reasons. That high-potency threats were at all prevalent on USB drives bound for industrial control facility use is the first concern. [...]” Honeywell said in its report.
Click to expand...

"Honeywell Industrial USB Threat Report" (PDF): https://honeywellprocess.blob.core.windows.net/public/Support/Customer/Honeywell-USB-Threat-Report.pdf

ronjor · Nov 1, 2018

AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)

Original release date: November 01, 2018
Vulnerabilities: Stack-based Buffer Overflow, Empty Password in Configuration File
4. MITIGATIONS
AVEVA recommends that users upgrade to InduSoft Web Studio v8.1 SP2 and InTouch Edge HMI (formerly InTouch Machine Edition) 2017 SP2 as soon as possible. Software updates can be downloaded from the Global Customer Support “Software Download” area or from the links below:
Click to expand...

ronjor · Nov 1, 2018

Schneider Electric Software Update (SESU)

Original release date: November 01, 2018
Vulnerability: DLL hijacking
4. MITIGATIONS
Schneider Electric has created a fix for this vulnerability (Version 2.2.0) which is available at the following location:
Click to expand...

ronjor · Nov 1, 2018

Circontrol CirCarLife

Original release date: November 01, 2018
Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Insufficiently Protected Credentials
4. MITIGATIONS
Circontrol has released a new version of the software that is available at (login required):
Click to expand...

ronjor · Nov 1, 2018

Fr. Sauter AG CASE Suite

Original release date: November 01, 2018
Vulnerability: Improper Restriction of XML External Entity Reference
4. MITIGATIONS
Fr. Sauter AG recommends users apply Service Release 1 for the current CASE Suite Version 3.10. The software is deployed via local support channels.
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Nov 1, 2018

Rockwell Automation Stratix 5100 (Update A)

Original release date: October 26, 2017 | Last revised: November 01, 2018
Vulnerability: Reusing a Nonce
5. MITIGATIONS
Rockwell Automation recommends that all users patch the clients that connect to the Stratix 5100 WAP/WGB, and recommends contacting a supplier to get the most updated compatible patch. However, patching the client only protects the connection formed by that specific client. In order to protect all future clients, Rockwell Automation recommends patching the Stratix 5100 WAP/WGB when the firmware is available.
Click to expand...

ronjor · Nov 1, 2018

Texas Instrument Microcontrollers CC2640 and CC2650 are vulnerable to variable and heap overflow.

Original Release date: 01 Nov 2018 | Last revised: 01 Nov 2018
Overview
Texas Instrument Microcontrollers CC2640 and CC2650 are vulnerable to variable and heap overflow.
Solution
Update the BLE-Stack
This vulnerability was patched in BLE-Stack v2.2.2 released by Texas Instruments on March 28, 2018. Affected devices will require a firmware update to obtain the updated BLE-Stack.
Click to expand...

ronjor · Nov 1, 2018

Cisco ASA and FTD SIP Inspection denial-of-service vulnerability

Original Release date: 01 Nov 2018 | Last revised: 01 Nov 2018
Overview
Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) software fails to properly parse SIP traffic, whcih can result in a denial-of-service condition on affected devices.
Solution
The CERT/CC is currently unaware of a practical solution to this problem. Please consider the following workarounds:
Click to expand...

ronjor · Nov 6, 2018

Roche Point of Care Handheld Medical Devices

Original release date: November 06, 2018
Vulnerabilities: Improper Authentication, OS Command Injection, Unrestricted Upload of File with Dangerous Type, Improper Access Control
4. MITIGATIONS
Roche recommends the following mitigation procedures for connected devices (Ethernet and Wi-Fi):
Click to expand...

ronjor · Nov 6, 2018

Schneider Electric Software Update (SESU) (Update A)

Original release date: November 01, 2018 | Last revised: November 06, 2018
Vulnerability: DLL hijacking
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-305-02 Schneider Electric Software Update that was published November 1, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Nov 8, 2018

Roche Diagnostics Point of Care Handheld Medical Devices (Update A)

Original release date: November 06, 2018 | Last revised: November 08, 2018
Vulnerabilities: Improper Authentication, OS Command Injection, Unrestricted Upload of File with Dangerous Type, Improper Access Control
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSMA-18-310-01 Roche Point of Care Handheld Medical Devices that was published November 6, 2018 on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Nov 8, 2018

Philips iSite and IntelliSpace PACS

Original release date: November 08, 2018
Vulnerability: Weak Password Requirements
4. MITIGATIONS
Philips recommends that users ensure IntelliSpace PACS installations run in a managed service environment that adheres to NCCIC recommendations to minimize the risk of exploitation (Virtual Private Network, Firewall isolation from other networks, no Internet access).
Click to expand...

ronjor · Nov 13, 2018

Siemens IEC 61850 System Configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ

Analyzer, and SICAM SCC
Original release date: November 13, 2018
Vulnerability: Improper Access Control
4. MITIGATIONS
Siemens has released updates for the affected products and recommends users update to the newest version.
Click to expand...

ronjor · Nov 13, 2018

Siemens S7-400 CPUs

Original release date: November 13, 2018
Vulnerabilities: Improper Input Validation
4. MITIGATIONS
Siemens recommends implementing the following mitigations:
Click to expand...

ronjor · Nov 13, 2018

Siemens SIMATIC Panels and SIMATIC WinCC (TIA Portal)

Original release date: November 13, 2018
Vulnerability: Code Injection
4. MITIGATIONS
Siemens has provided updates for the following products to fix the vulnerability. The update can be located here:
Click to expand...

ronjor · Nov 13, 2018

Siemens SCALANCE S

Original release date: November 13, 2018
Vulnerability: Cross-site Scripting
4. MITIGATIONS
Siemens has recommended that users update to Version 4.0.1.1, which can be found here:
Click to expand...

ronjor · Nov 13, 2018

Siemens SIMATIC S7

Original release date: November 13, 2018
Vulnerability: Resource Exhaustion
4. MITIGATIONS
Siemens recommends users of SIMATIC S7-1500 update to Version 2.6, which can be downloaded at the following location:
Click to expand...

ronjor · Nov 13, 2018

Siemens SIMATIC STEP 7 (TIA Portal)

Original release date: November 13, 2018
Vulnerability: Unprotected Storage of Credentials
4. MITIGATIONS
Siemens recommends users update to Version 15.1, which can be located here:
Click to expand...

ronjor · Nov 13, 2018

Siemens SIMATIC IT Production Suite

Original release date: November 13, 2018
Vulnerability: Improper Authentication
4. MITIGATIONS
Siemens provides updates to address this vulnerability in these products and recommends users update to the new version.
Click to expand...

ronjor · Nov 13, 2018

Siemens SIMATIC Panels

Original release date: November 13, 2018
Vulnerabilities: Path Traversal, Open Redirect
4. MITIGATIONS
Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches