The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Jun 23, 2022

Yokogawa CAMS for HIS

Original release date: June 23, 2022
Vulnerability: Violation of Secure Design Principles
Click to expand...

ronjor · Jun 23, 2022

OFFIS DCMTK

Original release date: June 23, 2022
Vulnerabilities: Path Traversal, Relative Path Traversal, NULL Pointer Dereference
Click to expand...

ronjor · Jun 23, 2022

Yokogawa STARDOM

Original release date: June 23, 2022
Vulnerabilities: Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials
Click to expand...

CISA is aware of a public report known as, “OT:ICEFALL,” which details vulnerabilities found in multiple operational technology (OT) vendors. CISA is issuing this advisory to provide notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
Click to expand...

ronjor · Jun 27, 2022

CISA Adds Eight Known Exploited Vulnerabilities to Catalog  

Original release date: June 27, 2022
CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the "Date Added to Catalog" column, which will sort by descending dates.    
Click to expand...

ronjor · Jun 28, 2022

ABB e-Design

Original release date: June 28, 2022
Vulnerabilities: Incorrect Default Permissions
Click to expand...

ronjor · Jun 28, 2022

Omron SYSMAC CS/CJ/CP Series and NJ/NX Series

Original release date: June 28, 2022
Vulnerabilities: Cleartext Transmission of Sensitive Information, Insufficient Verification of Data Authenticity, Plaintext Storage of a Password
Click to expand...

CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology (OT) vendors. CISA is issuing this advisory to provide notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
Click to expand...

ronjor · Jun 28, 2022

Advantech iView

Original release date: June 28, 2022
Vulnerabilities: SQL Injection, Missing Authentication for Critical Function, Relative Path Traversal, Command Injection
Click to expand...

ronjor · Jun 28, 2022

Motorola Solutions MOSCAD IP and ACE IP Gateways

Original release date: June 28, 2022
Vulnerability: Missing Authentication for Critical Function
Click to expand...

CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology (OT) vendors. CISA is issuing this advisory to provide notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
Click to expand...

ronjor · Jun 28, 2022

Motorola Solutions MDLC

Original release date: June 28, 2022
Vulnerabilities: Use of a Broken or Risky Cryptographic Algorithm, Plaintext Storage of a Password
Click to expand...

CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology (OT) vendors. CISA is issuing this advisory to provide notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
Click to expand...

ronjor · Jun 28, 2022

Motorola Solutions ACE1000

Original release date: June 28, 2022
Vulnerabilities: Use of Hard-coded Cryptographic Key, Use of Hard-coded Credentials, Insufficient Verification of Data Authenticity
Click to expand...

CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology (OT) vendors. CISA is issuing this advisory to provide notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
Click to expand...

ronjor · Jun 30, 2022

Exemys RME1 30 June 2022

This advisory contains mitigations for an Improper Authentication vulnerability in the Exemys RME1 analog acquisition module.
Click to expand...

ronjor · Jun 30, 2022

Yokogawa Wide Area Communication Router 30 June 2022

This advisory contains mitigations for a Use of Insufficiently Random Values vulnerability in the Yokogawa Wide Area Communication Router.
Click to expand...

ronjor · Jun 30, 2022

Emerson DeltaV Distributed Control System 30 June 2022

This advisory contains mitigations for Missing Authentication for Critical Function, Use of Hard-coded Credentials, Insufficient Verification of Data Authenticity, and Use of a Broken or Risky Cryptographic Algorithm vulnerabilities in the Emerson DeltaV Distributed Control System software management platform.
Click to expand...

ronjor · Jun 30, 2022

Distributed Data Systems WebHMI 30 June 2022

This advisory contains mitigations for Cross-site Scripting, and OS Command Injection vulnerabilities in the Distributed Data Systems WebHMI SCADA system.
Click to expand...

ronjor · Jun 30, 2022

Mitsubishi Electric FA Engineering Software (Update A) 30 June 2022

This updated advisory is a follow-up to the original advisory titled ICSA-21-350-05 Mitsubishi Electric FA Engineering Software that was published December 16, 2021, on the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Out-of-bounds Read, and Integer Underflow vulnerabilities in Mitsubishi Electric's FA Engineering Software products.
Click to expand...

ronjor · Jun 30, 2022

CODESYS Gateway Server (Update A) 30 June 2022

This updated advisory is a follow-up to the original advisory titled ICSA-15-258-02 3S CODESYS Gateway Server Buffer overflow Vulnerability that was published September 15, 2015, on the ICS webpage at cisa.gov/ics. This advisory provides mitigation details for a Heap-based Buffer Overflow vulnerability in CODESYS Gateway Server products.
Click to expand...

ronjor · Jul 1, 2022

CISA Adds One Known Exploited Vulnerability to Catalog

Original release date: July 01, 2022
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the "Date Added to Catalog" column, which will sort by descending dates.
Click to expand...

ronjor · Jul 7, 2022

Rockwell Automation MicroLogix 07 July 2022

This advisory contains mitigations for an Improper Restriction of Rendered UI Layers or Frames vulnerability in the Rockwell Automation MicroLogix controllers.
Click to expand...

ronjor · Jul 7, 2022

Bently Nevada ADAPT 3701-4X Series and 60M100 07 July 2022

This advisory contains mitigations for Use of Hard-coded Credentials and Missing Authentication for Critical Function vulnerabilities in the Bently Nevada ADAPT 3701-4X Series and 60M100 machinery monitors.
Click to expand...

ronjor · Jul 7, 2022

Mitsubishi Electric MELSEC iQ-R Series C Controller Module (Update B) 07 July 2022

This updated advisory is a follow-up to the original advisory titled ICSA-21-280-04 Mitsubishi Electric MELSEC iQ-R Series C Controller Module (Update A) that was published October 28, 2021, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for an Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series C controller module products.
Click to expand...

ronjor · Jul 12, 2022

Dahua ASI7213X-T1

Original release date: July 12, 2022
Vulnerabilities: Improper Input Validation, Unrestricted Upload of File with Dangerous Type, Authentication Bypass by Capture-replay, Generation of Error Message Containing Sensitive Information
Click to expand...

ronjor · Jul 12, 2022

Schneider Electric Easergy P5 and P3 (Update A)

Original release date: July 12, 2022
Vulnerabilities: Use of Hard-Coded Credentials, Classic Buffer Overflow, and Improper Input Validation
Click to expand...

ronjor · Jul 12, 2022

CISA Adds One Known Exploited Vulnerability to Catalog 

Original release date: July 12, 2022
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the "Date Added to Catalog" column, which will sort by descending dates.
Click to expand...

ronjor · Jul 14, 2022

Siemens SCALANCE X Switch Devices

This advisory contains mitigations for Use of Insufficiently Random Values, and Classic Buffer Overflow vulnerabilities in the Siemens SCALANCE X Switch Devices industrial ethernet switches.
Click to expand...

ronjor · Jul 14, 2022

Siemens SICAM GridEdge

This advisory contains mitigations for an Exposure of Resource to Wrong Sphere vulnerability in the Siemens SICAM GridEdge.
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches