The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Dec 19, 2017

Siemens LOGO! Soft Comfort

Original release date: December 19, 2017
MITIGATION

Siemens removed the Update Center from LOGO! Soft Comfort V8.2 and provides SHA-256 checksums for all LOGO! Soft Comfort software packages via a secured HTTPS channel. Siemens recommends verifying legitimacy by comparing the SHA-256 checksum of the downloaded software package with the SHA-256 checksum provided for the software package. Software version 8.2 for LOGO! Soft Comfort and SHA-256 checksums for LOGO! Soft Comfort downloads can be obtained via:
Click to expand...

ronjor · Dec 19, 2017

WECON Technology Co., Ltd. LeviStudio HMI

Original release date: December 19, 2017
MITIGATION

WECON recommends that users update to the latest version, which can be found at the following location:
Click to expand...

ronjor · Dec 21, 2017

Moxa NPort W2150A and W2250A

Original release date: December 21, 2017
MITIGATION

Moxa has produced new firmware Version 2.1 for the affected devices that can be downloaded from:
Click to expand...

ronjor · Dec 21, 2017

Schneider Electric Pelco VideoXpert Enterprise

Original release date: December 21, 2017
MITIGATION

Schneider Electric has released firmware Version 2.1 for VideoXpert to address these vulnerabilities. It can be downloaded from the following location:
Click to expand...

ronjor · Jan 4, 2018

Advantech WebAccess

Original release date: January 04, 2018
MITIGATION

Advantech has released WebAccess Version 8.3 to address the reported vulnerabilities. Users can download the latest version of WebAccess at the following location (registration required):
Click to expand...

ronjor · Jan 4, 2018

Delta Electronics Delta Industrial Automation Screen Editor

Original release date: January 04, 2018
MITIGATION

Delta Electronics recommends affected users update to the latest version of DOPSoft Version 2, which is available for download at:
Click to expand...

ronjor · Jan 4, 2018

Siemens SIPROTEC 4 and SIPROTEC Compact (Update E)

Original release date: July 06, 2017 | Last revised: January 04, 2018
UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-187-03D Siemens SIPROTEC 4 and SIPROTEC Compact that was published November 30, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Jan 9, 2018

General Motors and Shanghai OnStar (SOS) iOS Client

Original release date: January 09, 2018
REPOSTED INFORMATION
This advisory was originally posted to the NCCIC Portal on August 22, 2017, and is being released to the ICS-CERT web site.
AFFECTED PRODUCTS
The following version of Shanghai OnStar iOS Client, a vehicle management mobile application, is affected: Shanghai OnStar iOS Client Version 7.1
Click to expand...

ronjor · Jan 9, 2018

Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers

Original release date: January 09, 2018
MITIGATION

Rockwell Automation encourages affected users to upgrade to the latest version of available firmware, FRN 21.003, which can be obtained from:
Click to expand...

ronjor · Jan 11, 2018

WECON Technology Co., Ltd. LeviStudio HMI Editor

Original release date: January 11, 2018
MITIGATION

WECON recommends that users update to the latest version, which can be found at the following location:
Click to expand...

ronjor · Jan 11, 2018

Moxa MXview

Original release date: January 11, 2018
MITIGATION

Moxa has produced new firmware Version 2.9 for the affected devices that can be downloaded from:
Click to expand...

ronjor · Jan 11, 2018

PHOENIX CONTACT FL SWITCH

Original release date: January 11, 2018
MITIGATION

PHOENIX CONTACT recommends that affected users upgrade to firmware Version 1.33 or higher. The updated firmware may be downloaded from the following locations:
Click to expand...

ronjor · Jan 11, 2018

Meltdown and Spectre Vulnerabilities

Original release date: January 11, 2018
SUMMARY
NCCIC/ICS-CERT is referencing CERT/CC’s vulnerability note VU#584653 CPU hardware vulnerable to side-channel attacks to enhance the awareness of critical infrastructure asset owners/operators and to identify affected product vendors that have contacted ICS-CERT for help disseminating customer notifications/recommendations to mitigate the risk associated with cache side-channel attacks known as Meltdown (link is external) and Spectre (link is external). Exploitation of these vulnerabilities may allow unauthorized disclosure of information.
Click to expand...

ronjor · Jan 18, 2018

Siemens SIMATIC WinCC Add-On

Original release date: January 18, 2018
IMPACT
Successful exploitation of these vulnerabilities could allow remote code execution or a denial of service condition.
MITIGATION
Gemalto has released an updated installer and Siemens strongly encourages users upgrade to the new installer as soon as possible. The new installer is available at:
Click to expand...

ronjor · Jan 18, 2018

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update H)

Original release date: May 09, 2017 | Last revised: January 18, 2018
UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-02G Siemens devices using the PROFINET Discovery and Configuration Protocol that was published November 28, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

itman · Jan 22, 2018

14 Flaws in Popular Software Are Putting ICS at Risk

A variety of serious vulnerabilities have been identified in popular license management software used in corporate and industrial control system (ICS) environments to activate software on PCs and servers.

According to Kaspersky Lab ICS CERT researchers, 14 vulnerabilities in the Hardware Against Software Piracy (HASP) license management system mean that license management USB tokens can be used to open a hidden remote-access channel for cyber-attackers.

The flaws include multiple denial-of-service (DoS) vulnerabilities and several remote code execution issues. These are automatically exploited not with user rights but with the most privileged system rights, providing attackers with an opportunity to execute any arbitrary code they wish.

“The USB-tokens in question are widely used in different organizations to serve the purpose of convenient software license activation,” researchers explained in their analysis. “In normal use case scenarios, a company’s system administrator would need to approach the computer with the software that needs to be activated and insert the token. It will then confirm that the software of interest is legitimate (not pirated) and would activate it.”

The problem is, upon installation, the software adds port 1947 of the computer to the list of exclusions of the Windows Firewall with no proper user notification, which makes it vulnerable to a remote attack.
Click to expand...

https://www.infosecurity-magazine.com/news/14-flaws-in-popular-software-ics/

ronjor · Jan 23, 2018

Advantech WebAccess/SCADA

Original release date: January 23, 2018
MITIGATION

Advantech has released a version 8.3.0 of WebAccess/SCADA to address the reported vulnerabilities. Users can download the latest version of WebAccess/SCADA at the following location (registration required):
Click to expand...

ronjor · Jan 23, 2018

Siemens Industrial Products

Original release date: January 23, 2018

CVSS v3 6.5
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: Siemens
Equipment: Industrial Products
Vulnerability: Improper Input Validation
Click to expand...

ronjor · Jan 23, 2018

Siemens Industrial Products (Update B)

Original release date: December 05, 2017 | Last revised: January 23, 2018
UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-339-01A Siemens Industrial Products that was published December 19, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Jan 23, 2018

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update H)

Original release date: May 09, 2017 | Last revised: January 23, 2018
UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-01G Siemens devices using the PROFINET Discovery and Configuration Protocol that was published November 14, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Jan 25, 2018

Nari PCS-9611

Original release date: January 25, 2018
MITIGATION

NCCIC has reached out to Nari and CNCERT but has not received a response.
Click to expand...

ronjor · Jan 25, 2018

Siemens Desigo PXC

Original release date: January 25, 2018
MITIGATION

Siemens has provided an updated version that fixes the vulnerability for the affected products and recommends users update to the newest version V6.00.204 or a later version that can be obtained at:
Click to expand...

ronjor · Jan 25, 2018

Philips IntelliSpace Cardiovascular System Vulnerability

Original release date: January 25, 2018
AFFECTED PRODUCTS

Philips reports that the vulnerability affects the following versions of the IntelliSpace Cardiovascular:

IntelliSpace Cardiovascular, Version 2.3.0 and prior.
Click to expand...

ronjor · Jan 25, 2018

Siemens Industrial Products (Update C)

Original release date: December 05, 2017 | Last revised: January 25, 2018
UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-339-01B Siemens Industrial Products that was published January 23, 2018, on the NCCIC/ICS-CERT web site.
Click to expand...

ronjor · Jan 25, 2018

Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update C)

Original release date: November 14, 2017 | Last revised: January 25, 2018
UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-318-01B Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products that was published December 19, 2017, on the NCCIC/ICS-CERT web site.
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

itman Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

itman Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches