The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Nov 16, 2017

Moxa NPort 5110, 5130, and 5150

Original release date: November 16, 2017
ATTENTION: Remotely exploitable/low skill level to exploit.
MITIGATION
Moxa has produced new firmware for the affected devices that can be downloaded from:
Click to expand...

ronjor · Nov 21, 2017

PHOENIX CONTACT WLAN Capable Devices using the WPA2 Protocol

Original release date: November 21, 2017
ATTENTION: Public exploits are available.
Vendor: PHOENIX CONTACT
Equipment: WLAN capable devices using the WPA2 Protocol
Vulnerabilities: Reusing a Nonce
MITIGATION
PHOENIX CONTACT has reported that users operating embedded devices in AP mode are not affected by these vulnerabilities. PHOENIX CONTACT is actively working on discovering how these vulnerabilities affect its products and plans to release future updates as they become available. For more information, please see the advisory at this location:
Click to expand...

ronjor · Nov 28, 2017

Siemens SCALANCE W1750D, M800, and S615

Original release date: November 28, 2017
MITIGATION
For SCALANCE W1750D: Users who do not use the “OpenDNS,” “Captive Portal,” or “URL redirection” functionalities can deploy firewall rules in the device configuration to block incoming access to Port 53/UDP.
For SCALANCE M800/S615: Disable DNS proxy in the device configuration (System - DNS - DNS Proxy - Disable Checkbox for Enable DNS Proxy) and configure the connected devices in the internal network to use a different DNS server.
Apply Defense-in-Depth
Siemens reports they are preparing updates for the affected products and recommends the following mitigations until patches are available:
Siemens has produced an advisory that can be found at:
Click to expand...

ronjor · Nov 28, 2017

Ethicon Endo-Surgery Generator G11 Vulnerability

Original release date: November 28, 2017
MITIGATION

Ethicon Endo-Surgery, LLC has contacted users and initiated a field cybersecurity update to address the vulnerability in the Ethicon Endo-Surgery Generator Gen11. The update will be made available on November 29, 2017. Users with questions regarding the vulnerability or the product update are advised to contact their Ethicon Endo-Surgery, LLC sales representative or Ethicon Customer Support Center at 1-877-ETHICON.
Click to expand...

ronjor · Nov 28, 2017

Siemens Industrial Products DROWN Vulnerability (Update C)

Original release date: April 12, 2016 | Last revised: November 28, 2017
OVERVIEW
This updated advisory is a follow-up to the updated advisory titled ICSA-16-103-03B Siemens Industrial Products DROWN Vulnerability that was published June 15, 2017, on the NCCIC/ICS-CERT web site.
Siemens has found that a DROWNa (Decrypting RSA with Obsolete and Weakened eNcryption) attack can affect some Siemens industrial products under certain conditions. Siemens recommends specific countermeasures until patches are available.
This vulnerability could be exploited remotely. Exploits that target this vulnerability are known to be publicly available.
Click to expand...

ronjor · Nov 28, 2017

Siemens S7-300/400 PLC Vulnerabilities (Update C)

Original release date: December 13, 2016 | Last revised: November 28, 2017
OVERVIEW
This updated advisory is a follow-up to the updated advisory titled ICSA-16-348-05B Siemens S7-300/400 PLC Vulnerabilities that was published July 25, 2017, on the NCCIC/ICS-CERT web site.

Zhu WenZhe from Beijing Acorn Network Technology has identified password leak and denial-of-service (DoS) vulnerabilities in Siemens’ S7-300 and S7-400 programmable logic controllers (PLCs). Siemens has released Security Advisory SSA-731239 with advice to mitigate these vulnerabilities.
These vulnerabilities could be exploited remotely.
Click to expand...

ronjor · Nov 28, 2017

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update G)

Original release date: May 09, 2017 | Last revised: November 28, 2017
UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-02F Siemens devices using the PROFINET Discovery and Configuration Protocol that was published November 14, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Nov 30, 2017

Geovap Reliance SCADA

Original release date: November 30, 2017
IMPACT
Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject arbitrary JavaScript in a specially crafted URL request that may allow for read/write access.
MITIGATION
Geovap has released Version 4.7.3 Update 3 of the software which can be found at:
Click to expand...

ronjor · Nov 30, 2017

Siemens SWT3000

Original release date: November 30, 2017
IMPACT
Successful exploitation of these vulnerabilities under certain conditions may allow attackers to perform a denial-of-service attack.
MITIGATION
Siemens has provided updated firmware that fixes the vulnerabilities for the following affected products and recommends users update to the newest version:
Click to expand...

ronjor · Nov 30, 2017

Siemens SIMATIC Authentication Bypass (Update C)

Original release date: February 14, 2017 | Last revised: November 30, 2017
UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03B Siemens SIMATIC Authentication Bypass that was published July 6, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Nov 30, 2017

Siemens SIPROTEC 4 and SIPROTEC Compact (Update D)

Original release date: July 06, 2017 | Last revised: November 30, 2017
UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-187-03C Siemens SIPROTEC 4 and SIPROTEC Compact that was published October 10, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Nov 30, 2017

Siemens Industrial products using the Discovery Service of the OPC UA protocol stack by the OPC foundation (Update B)

Original release date: October 03, 2017 | Last revised: November 30, 2017
UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-17-242-01A Siemens Industrial products using the Discovery Service of the OPC UA protocol stack by the OPC foundation that was published October 3, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Dec 5, 2017

The Year to Come in ICS / Critical Infrastructure Security

By Galina Antova on December 05, 2017
Here, I wanted to address some of my thoughts about what the New Year will hold for Industrial Control Systems/Critical Infrastructure cybersecurity. It is “Security Prediction Season” after all and I’d be remiss not to offer my thoughts. Below I’ve outlined a few things I think that will definitely manifest – some are bad, some offer more promise for placing us on a path to combatting an adversarial scourge which is growing in this absolutely critical area.
Click to expand...

ronjor · Dec 5, 2017

Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update A)

Original release date: November 14, 2017 | Last revised: December 05, 2017
UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-17-318-01 Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products that was published November 14, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Dec 5, 2017

Siemens Industrial Products

Original release date: December 05, 2017
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: Siemens
Equipment: Industrial products
Vulnerability: Improper Input Validation
AFFECTED PRODUCTS
Siemens reports the vulnerability affects the following industrial products:
Click to expand...

ronjor · Dec 7, 2017

Xiongmai Technology IP Cameras and DVRs

Original release date: December 07, 2017
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: Xiongmai Technology
Equipment: IP Cameras and DVRs
Vulnerability: Stack-based Buffer Overflow
MITIGATION
Xiongmai Technology has not responded to requests to coordinate with NCCIC/ICS-CERT.
ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Dec 7, 2017

Rockwell Automation FactoryTalk Alarms and Events

Original release date: December 07, 2017
IMPACT
Successful exploitation of this vulnerability may allow an attacker to cause a denial of service condition in the in the history archiver service running on FactoryTalk Alarms and Events.
MITIGATION
Rockwell Automation recommends upgrading to the latest version of FactoryTalk Alarms and Events, Version 2.90 or later, and applying available patches, which can be obtained at the following location:
Click to expand...

ronjor · Dec 7, 2017

PHOENIX CONTACT FL COMSERVER, FL COM SERVER, and PSI-MODEM/ETH

Original release date: December 07, 2017
IMPACT
Successful exploitation of this vulnerability may allow a remote attacker to change configuration variables on the device.
MITIGATION
PHOENIX CONTACT has released new firmware versions for the affected devices. The latest download links can be found at:
Click to expand...

ronjor · Dec 12, 2017

Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Vulnerabilities (Update A)

Original release date: September 07, 2017 | Last revised: December 12, 2017
OVERVIEW
This updated advisory is a follow-up to the original advisory titled ICSMA-17-250-02 Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Vulnerabilities that was published September 7, 2017, on the NCCIC/ICS-CERT web site.
Independent researcher Scott Gayou has identified eight vulnerabilities in Smiths Medical’s Medfusion 4000 Wireless Syringe Infusion Pump.
Click to expand...

ronjor · Dec 14, 2017

Hackers shut down infrastructure safety system in attack: FireEye

Jim Finkle
(Reuters) - Hackers likely working for a nation-state recently penetrated the safety system of a critical infrastructure facility in an attack that caused operations to shut down, according to cyber security firm FireEye Inc, which said it investigated the incident.
Click to expand...

Minimalist · Dec 16, 2017

CyberX who analyzed samples of the Triton malware believes it was likely developed by Iran and used to target an organization in Saudi Arabia.
Click to expand...

https://securityaffairs.co/wordpress/66784/malware/triton-malware-iran.html

ronjor · Dec 19, 2017

Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update B)

Original release date: November 14, 2017 | Last revised: December 19, 2017
UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-318-01A Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products that was published December 5, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Dec 19, 2017

ABB Ellipse

Original release date: December 19, 2017
MITIGATION

ABB has released the following product updates to mitigate the vulnerability:
Click to expand...

ronjor · Dec 19, 2017

PEPPERL+FUCHS/ecom instruments WLAN Capable Devices using the WPA2 Protocol

Original release date: December 19, 2017
MITIGATION

PEPPERL+FUCHS/ecom instruments report the following mitigations:
Click to expand...

ronjor · Dec 19, 2017

Ecava IntegraXor

Original release date: December 19, 2017
MITIGATION

Ecava recommends that users of affected IntegraXor versions update to version 6.1.1215.0 or newer, a download for which can be found at the following location:
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches