The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Jun 14, 2018

Siemens Industrial Products Local Privilege Escalation Vulnerability (Update H)

Original release date: November 08, 2016 | Last revised: June 14, 2018
Vulnerability: Improper privilege management
5. MITIGATIONS
If the affected products are installed under their default path (“C:\Program Files\*” or the localized equivalent) and the default file system access permissions for drive C:\ were not modified, the security vulnerability is not exploitable.
However, if the affected products are not installed under their default path (“C:\Program Files\*” or the localized equivalent), the security vulnerability is potentially exploitable.
Click to expand...

guest · Jun 18, 2018

Pwned with '4 lines of code': Researchers warn SCADA systems are still hopelessly insecure
How Shamoon and Stuxnet et al ran riot
June 18, 2018
https://www.theregister.co.uk/2018/06/18/physically_hacking_scada_infosec/

A presentation at last week's BSides conference by researchers from INSINIA [...] Godfrey explained that security has never been a design criteria for industrial control kit and this hasn't changed with the advent of IoT in the domain of SCADA systems. As a result, issues such as default hard-coded credentials and lack of encryption abound.

Worse yet, most systems are running either old or hopelessly obsolete versions of Windows. Most terminals are running Windows 7 but some run Windows 98, according to Matt Carr, CTO of INSINIA.

INSINIA has developed a device that automatically scans networks and shuts down components. The "weaponised" Arduino micro-controller looks like a regular programmable logic controller (PLC) to other devices on the network. If it is physically planted on a targeted environment, it can quickly enumerate networks before sending stop commands. It can "kill industrial processes with only four lines of code", according to Godfrey.
Click to expand...

ronjor · Jun 21, 2018

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update J)

Original release date: May 09, 2017 | Last revised: June 21, 2018
2. UPDATE INFORMATION
Vulnerability: Improper Input Validation
This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-01I Siemens devices using the PROFINET Discovery and Configuration Protocol (Update I) that was published February 27, 2018, on the NCCIC/ICS-CERT website
Click to expand...

ronjor · Jun 21, 2018

Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix

Original release date: June 21, 2018
Vulnerability: Improper Input Validation
4. MITIGATIONS

Rockwell Automation recommends users with affected controllers apply firmware revision FRN (31.011 or later) to the affected products. The download can be obtained at the following location:
Click to expand...

ronjor · Jun 21, 2018

Delta Electronics Delta Industrial Automation COMMGR

Original release date: June 21, 2018
Vulnerability: Stack-based Buffer Overflow
4. MITIGATIONS

Delta Electronics has released COMMGR v1.09 to address this vulnerability and recommends users upgrade. The updated version can be downloaded at:
Click to expand...

guest · Jun 21, 2018

Four New Vulnerabilities in Phoenix Contact Industrial Switches
A series of newly disclosed vulnerabilities could allow an attacker to gain control of industrial switches.
June 21,2018
https://www.darkreading.com/iot/fou...ix-contact-industrial-switches/d/d-id/1332121

Phoenix Contact has disclosed four vulnerabilities in switches in the FL SWITCH industrial line. The affected devices are typically used in automated processes at digital substations, oil and gas, maritime, and other industrial applications.

CVE-2018-10728 involves a buffer overflow that could be exploited to perform a DoS attack, disable web and telnet services, or run arbitrary code, while CVE-2018-10729 would allow an unauthorized user to read the contents of the switch config file.

For more, read here.
Click to expand...

ronjor · Jun 21, 2018

Global Threats to Information Systems

Original release date: June 21, 2018
NCCIC encourages users and administrators to review Securing Network Infrastructure Devices and the United Kingdom’s National Cyber Security Centre (NCSC) guidance on Internet Edge Device Security and implement the following recommendations:
Click to expand...

ronjor · Jun 22, 2018

Securing Network Infrastructure Devices

Original release date: June 21, 2018
Network infrastructure devices are ideal targets for malicious cyber actors. Most or all organizational and customer traffic must traverse these critical devices
Click to expand...

.

Minimalist · Jun 27, 2018

Cisco ASA Flaw Exploited in the Wild After Publication of Two PoCs

Hackers are exploiting a vulnerability in Cisco software to crash and/or retrieve information from affected devices.

Cisco is aware of the issue and has warned customers last week, Friday, June 22.
Click to expand...

https://www.bleepingcomputer.com/ne...ed-in-the-wild-after-publication-of-two-pocs/

ronjor · Jun 28, 2018

Medtronic MyCareLink Patient Monitor

Original release date: June 28, 2018
Vulnerabilities: Use of Hard-coded Password, Exposed Dangerous Method or Function
4. MITIGATIONS
Medtronic will release several rolling over-the-air product updates that will mitigate the vulnerabilities described within this advisory. These updates will be applied to devices automatically as part of standard, reoccurring update processes. In addition, Medtronic has increased security monitoring of affected devices and related infrastructure.
Click to expand...

ronjor · Jun 28, 2018

Medtronic 2090 Carelink Programmer Vulnerabilities (Update A)

Original release date: February 27, 2018 | Last revised: June 28, 2018
Vulnerabilities: Storing Passwords in a Recoverable Format, Relative Path Traversal, Improper Restriction of Communication Channel to Intended Endpoints
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSMA-18-058-01 Medtronic 2090 CareLink Programmer Vulnerabilities that was published February 27, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

guest · Jul 3, 2018

Flaws Expose Siemens Central Plant Clocks to Attacks
July 3, 2018
https://www.securityweek.com/flaws-expose-siemens-central-plant-clocks-attacks

Siemens SICLOCK devices are used to synchronize time in industrial plants. The central plant clock ensures stability in case of a failure or loss of reception at the primary time source.

According to the German industrial giant, SICLOCK systems are affected by a total of six vulnerabilities. The security holes have been assigned the CVE identifiers CVE-2018-4851 through CVE-2018-4856.

Three of the flaws have been classified as critical. [...] Another critical vulnerability can be exploited by an attacker with access to UDP port 69 to modify the firmware on a targeted SICLOCK device. [...]
A high severity flaw disclosed by Siemens can allow a network attacker to bypass authentication, but exploitation requires the hacker to obtain specific information about the targeted device.

Mitigations include the installation of redundant time sources and implementation of plausibility checks for critical controllers in the plant, and protecting network access to impacted devices.
Click to expand...

ronjor · Jul 3, 2018

Rockwell Automation Allen-Bradley Stratix 5950

Original release date: July 03, 2018
Vulnerabilities: Improper Input Validation, Improper Certificate Validation, Resource Management Errors
4. MITIGATIONS
Rockwell Automation will inform users of updated firmware as soon as it is available. Rockwell Automation recommends that users using affected devices apply the following risk mitigation strategies:
Click to expand...

Minimalist · Jul 5, 2018

Year-Old Critical Vulnerabilities Patched in ISP Broadband Gear

Patches for three critical vulnerabilities impacting broadband gateways made by Advanced Digital Broadcast (ADB) have been released to the public, nearly two years after the bugs were first found. Issues range from a privilege escalation flaw, an authorization bypass vulnerability and a local jailbreak bug.
Click to expand...

https://threatpost.com/year-old-critical-vulnerabilities-patched-in-isp-broadband-gear/

ronjor · Jul 10, 2018

Schweitzer Engineering Laboratories, Inc. Compass and AcSELerator Architect

Original release date: July 10, 2018
Vulnerabilities: Incorrect Default Permissions, XXE, Resource Exhaustion
4. MITIGATIONS
SEL recommends affected users upgrade to latest release:
Click to expand...

ronjor · Jul 10, 2018

Universal Robots Robot Controllers

Original release date: July 10, 2018
Vulnerabilities: Use of Hard-coded Credentials, Missing Authentication for Critical Function
4. MITIGATIONS
Universal Robots recommends the follow remedial actions:
Click to expand...

ronjor · Jul 10, 2018

Meltdown and Spectre Vulnerabilities (Update H)

Original release date: January 11, 2018 | Last revised: July 10, 2018
1. EXECUTIVE SUMMARY

This updated alert is a follow-up to the updated alert titled ICS-ALERT-18-011-01 Meltdown and Spectre Vulnerabilities (Update G) that was published April 27, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

guest · Jul 12, 2018

Hackers Can Chain Multiple Flaws to Attack WAGO HMI Devices
July 11, 2018
https://www.securityweek.com/hackers-can-chain-multiple-flaws-attack-wago-hmi-devices

Germany-based industrial automation company WAGO has patched several vulnerabilities in its e!DISPLAY 7300T Web Panel human-machine interface (HMI) products that can be chained to take control of affected devices.

The security holes, discovered by researchers at security consultancy SEC Consult and rated “high severity,” include multiple reflected and one stored cross-site scripting (XSS) vulnerabilities (CVE-2018-12981), unrestricted file upload and file path manipulation issues (CVE-2018-12980), and an incorrect default permissions flaw (CVE-2018-12979).

This was not the first time SEC Consult identified vulnerabilities in WAGO products. Last year, the company reported finding a potentially serious vulnerability that could give a remote attacker access to an organization’s entire network.
Click to expand...

ronjor · Jul 12, 2018

Medtronic N'Vision Clinician Programmer (Update A)

Original release date: May 17, 2018 | Last revised: July 12, 2018
2. UPDATE INFORMATION

This updated advisory is a follow-up to the original advisory titled ICSMA-18-137-01 Medtronic N'Vision Clinician Programmer that was published May 17, 2018, on the NCCIC/ICS-CERT website
Click to expand...

ronjor · Jul 12, 2018

Eaton 9000X Drive

Original release date: July 12, 2018
Vulnerability: Stack-based Buffer Overflow
4. MITIGATIONS

Eaton has released an update for 9000X Drive that is available via the following link:
Click to expand...

ronjor · Jul 17, 2018

ABB Panel Builder 800

Original release date: July 17, 2018
Vulnerability: Improper Input Validation
4. MITIGATIONS
ABB is currently investigating this vulnerability and recommends users follow these suggestions until a corrected version is available.
Click to expand...

ronjor · Jul 17, 2018

Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix (Update A)

Original release date: June 21, 2018 | Last revised: July 17, 2018
Vulnerability: Improper Input Validation
5. MITIGATIONS
Rockwell Automation recommends users with affected controllers apply firmware revision FRN (31.011 or later) to the affected products. The download can be obtained at the following location:
Click to expand...

ronjor · Jul 17, 2018

PEPPERL+FUCHS VisuNet RM, VisuNet PC, and Box Thin Client

Original release date: July 17, 2018
Vulnerability: Improper Authentication
4. MITIGATIONS
PEPPRL+FUCHS recommends users using HMI devices within VisuNet RM, VisuNet PC or BTC product families follow these guidelines:
Click to expand...

ronjor · Jul 17, 2018

WAGO e!DISPLAY Web-Based-Management

Original release date: July 17, 2018
Vulnerabilities: Cross-site Scripting, Unrestricted Upload of File with Dangerous Type, and Incorrect Permissions for Critical Resource
4. MITIGATIONS
WAGO recommends affected users update to the latest firmware (FW 02). Contact WAGO support for update files and specific instructions.
Click to expand...

ronjor · Jul 19, 2018

AVEVA InduSoft Web Studio and InTouch Machine Edition

Original release date: July 19, 2018
Vulnerabilities: Stack-based buffer overflow
4. MITIGATIONS
Users of InduSoft Web Studio v8.1 SP1 are affected and should apply InduSoft Web Studio Hotfix 81.1.00.08 as soon as possible. Users of InduSoft Web Studio v8.1 are also affected and should first upgrade to InduSoft Web Studio v8.1 SP1 and then apply the hotfix.
Users of InTouch Machine Edition 2017 v8.1 SP1 are affected and should apply InTouch Machine Edition Hotfix 81.1.00.08 as soon as possible. Users of InTouch Machine Edition 2017 v8.1 are also affected and should first upgrade to InTouch Machine Edition 2017 v8.1 SP1 and then apply the hotfix.
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches