The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

guest · Nov 19, 2018

CVSS Scores Often Misleading for ICS Vulnerabilities: Experts
November 19, 2018
https://www.securityweek.com/cvss-scores-often-misleading-ics-vulnerabilities-experts

In a presentation at SecurityWeek’s ICS Cyber Security Conference in Atlanta last month, Radiflow CEO and Founder Ilan Barda pointed out that CVSS scoring was originally developed for IT systems and is often not accurate in the case of industrial systems, which can be problematic for organizations. Several other industrial cybersecurity experts contacted by SecurityWeek agree.
Impact of misleading CVSS scores on organizations
Misleading CVSS scores can have a serious impact on industrial organizations, according to the experts contacted by SecurityWeek.

“The misleading score makes it more difficult for the operators of ICS networks to prioritize the risk to their devices and to their physical processes,
Adapting CVSS to ICS and alternative scoring systems
Some experts believe that CVSS can still work for ICS vulnerabilities as long as the score is adapted accordingly and not used on its own.
Click to expand...

ronjor · Nov 20, 2018

NUUO CMS (Update A)

Original release date: October 11, 2018 | Last revised: November 20, 2018
Vulnerabilities: Use of Insufficiently Random Values, Use of Obsolete Function, Incorrect Permission Assignment for Critical Resource, Use of Hard-coded Credentials, Path Traversal, Unrestricted Upload of File with Dangerous Type, SQL Injection
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-284-02 NUUO CMS that was published October 11, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Nov 20, 2018

Schneider Electric Modicon M221

Original release date: November 20, 2018
Vulnerability: Insufficient Verification of Data Authenticity
4. MITIGATIONS
Schneider Electric recommends the following mitigations to reduce the risk:
Click to expand...

ronjor · Nov 20, 2018

Teledyne DALSA Sherlock

Original release date: November 20, 2018
Vulnerability: Stack-based Buffer Overflow
4. MITIGATIONS
Teledyne DALSA recommends users upgrade to Sherlock Version 7.2.7.5 or later. The latest update can be obtained from the following link:
Click to expand...

ronjor · Nov 27, 2018

AVEVA Vijeo Citect and Citect SCADA

Original release date: November 27, 2018
Vulnerability: Uncontrolled Search Path Element
4. MITIGATIONS
AVEVA recommends all affected users download and upgrade to the latest version of the Schneider Electric Software Update (SESU) software.
Click to expand...

ronjor · Nov 29, 2018

INVT Electric VT-Designer

Original release date: November 29, 2018
Vulnerabilities: Deserialization of Untrusted Data, Heap-based Buffer Overflow
4. MITIGATIONS

INVT Electric’s mitigations for these vulnerabilities are not yet available.

NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Dec 3, 2018

SamSam Ransomware

Original release date: December 03, 2018
The Department of Homeland Security and the Federal Bureau of Investigation have identified cyber threat actors using SamSam ransomware—also known as MSIL/SAMAS.A—to target industries in the United States and worldwide.
NCCIC encourages users and administrators to review Alert AA18-337A: SamSam Ransomware and Malware Analysis Reports AR18-337A, AR18-337B, AR18-337C, and AR18-337D for more information.
Click to expand...

ronjor · Dec 4, 2018

SpiderControl SCADA WebServer

Original release date: December 04, 2018
Vulnerability: Reflected Cross-site Scripting
4. MITIGATIONS
SpiderControl has released Version 2.03.0001, which fixes the vulnerability. The update can be found here:
Click to expand...

ronjor · Dec 4, 2018

Omron CX-One

Original release date: December 04, 2018
Vulnerabilities: Stack-based Buffer Overflow, Use After Free
4. MITIGATIONS
Omron has released an updated version of CX-One to address the reported vulnerabilities. These releases are available through the CX-One auto-update service.
Click to expand...

guest · Dec 4, 2018

M2M Protocols Expose Industrial Systems to Attacks
December 4, 2018
https://www.securityweek.com/m2m-protocols-expose-industrial-systems-attacks

The security firm has analyzed two popular M2M protocols: Message Queuing Telemetry Transport (MQTT), which facilitates communications between a broker and multiple clients, and the Constrained Application Protocol (CoAP), a UDP-based server-client protocol that allows HTTP-like communications between nodes.

In the case of MQTT, Trend Micro researchers discovered vulnerabilities in both the protocol itself and its implementations. The flaws can allow malicious actors to execute arbitrary code or cause a denial-of-service (DoS) condition, which, as experts have often warned, can pose a serious risk to industrial systems.

"[...] An attacker who has access to a 1-Mbps link would be able to hit a target at 32 Mbps,” explained Federico Maggi, one of the authors of the research paper.
Click to expand...

Research paper (PDF): https://documents.trendmicro.com/assets/white_papers/wp-the-fragility-of-industrial-IoTs-data-backbone.pdf?v1

ronjor · Dec 6, 2018

Philips HealthSuite Health Android App

Original release date: December 06, 2018
Vulnerability: Inadequate Encryption Strength
4. MITIGATIONS
A new release to mediate this vulnerability with be available during Quarter 1 of 2019.
As an interim mitigation to this vulnerability, Philips recommends the following:
Click to expand...

ronjor · Dec 6, 2018

GE Proficy GDS

Original release date: December 06, 2018
Vulnerability: XXE
4. MITIGATIONS
GE recommends users update to Version 2.1 or newer. The fixed version is available the following link:
Click to expand...

ronjor · Dec 6, 2018

Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules

Original release date: December 06, 2018
Vulnerability: Missing Authentication for Critical Function
5. MITIGATIONS
Rockwell Automation recommends users of affected products update to an available firmware revision that addresses the associated risk. Users who are unable to update their firmware are directed towards additional risk mitigation strategies provided herein and are encouraged to combine these with the general security guidelines to employ multiple strategies simultaneously, when possible.
Click to expand...

ronjor · Dec 11, 2018

McAfee SINAMICS PERFECT HARMONY GH180

Original release date: December 11, 2018
Vulnerability: Improper Access Control
4. MITIGATIONS
McAfee has issued Security Bulletin SB10250 to address this vulnerability in MACC. SINAMICS PERFECT HARMONY GH180 Drives with HMIs produced between November 4, 2015 and October 9, 2018, use MACC as part of their software package, if option A30 was part of the order.
Click to expand...

ronjor · Dec 11, 2018

Siemens SINUMERIK Controllers

Original release date: December 11, 2018
Vulnerabilities: Heap-based Buffer Overflow, Integer Overflow or Wraparound, Protection Mechanism Failure, Permissions, Privileges, and Access Controls, Stack-based Buffer Overflow, Uncaught Exception
4. MITIGATIONS
Siemens has released updates for several affected products and is working on updates for the remaining affected products. Siemens recommends updating affected devices as soon as possible. See below for details.
Click to expand...

ronjor · Dec 11, 2018

Philips Alice 6 Vulnerabilities (Update A)

Original release date: March 27, 2018 | Last revised: December 11, 2018
Vulnerabilities: Improper Authentication, Missing Encryption of Sensitive Data
5. MITIGATIONS
--------- Begin Update A Part 1 of 1 --------
Philips will notify users of the identified vulnerabilities and will coordinate with users to schedule updates. Philips is scheduled to release a new product version and supporting product documentation for Q1 of 2019. For all users of the Alice 6 System product, Version R8.0.2 or prior, Philips will update the devices to R8.0.3. Philips encourages users to use Philips validated and authorized changes only for the Alice 6 device supported by Philips’ authorized personnel or under Philips’ explicit published directions for patches, updates, or releases.
Click to expand...

ronjor · Dec 11, 2018

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update N)

Original release date: May 09, 2017 | Last revised: December 11, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-02 Siemens devices using the PROFINET Discovery and Configuration Protocol (Update M) that was published November 13, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Dec 11, 2018

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update N)

Original release date: May 09, 2017 | Last revised: December 11, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-02 Siemens devices using the PROFINET Discovery and Configuration Protocol (Update M) that was published November 13, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Dec 13, 2018

GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e

Original release date: December 13, 2018
Vulnerability: Path Traversal
4. MITIGATIONS
The path traversal vulnerability has been corrected by GE. GE recommends users upgrade to the current version of ControlST software as described in CSB25378
Click to expand...

ronjor · Dec 13, 2018

Geutebrück GmbH E2 Series IP Cameras

Original release date: December 13, 2018
Vulnerability: OS Command Injection
4. MITIGATIONS
Geutebrück recommends E2 series IP camera users download and update to the newest firmware version, 1.12.0.25, by registering for a new WebClub account, or by logging into an existing account at the following location:
Click to expand...

ronjor · Dec 13, 2018

Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays

Original release date: December 13, 2018
Vulnerabilities: Improper Input Validation
4. MITIGATIONS
Siemens has released updates for several affected products. Siemens is working on updates for the remaining affected products, and recommends specific countermeasures until fixes are available.
Click to expand...

ronjor · Dec 13, 2018

Schneider Electric GUIcon Eurotherm

Original release date: December 13, 2018
Vulnerabilities: Type Confusion, Stack-based Buffer Overflow
4. MITIGATIONS
Schneider Electric recommends upgrading to GUIcon Version 2.0 Software Package (Gold Build 683.003), which includes fixes for these vulnerabilities is available for download below:
Click to expand...

ronjor · Dec 13, 2018

Medtronic 9790, 2090 CareLink, and 29901 Encore Programmers

Original release date: December 13, 2018
Vulnerability: Missing Encryption of Sensitive Data
4. MITIGATIONS
The CareLink 9790 Programmer has been placed into end-of-life status and is no longer supported by Medtronic. Medtronic recommends users no longer use the 9790 for any purpose.
Click to expand...

ronjor · Dec 13, 2018

Medical Advisory (ICSMA-18-086-01)

Philips Alice 6 Vulnerabilities (Update B)
Original release date: March 27, 2018 | Last revised: December 13, 2018
Vulnerabilities: Improper Authentication, Missing Encryption of Sensitive Data
5. MITIGATIONS
--------- Begin Update B Part 2 of 2 --------
Philips will notify users of the identified vulnerabilities and will coordinate with users to schedule updates. Philips is scheduled to release a new product version and supporting product documentation for Q1 of 2019. For all users of the Alice 6 System product, Version R8.0.3 or prior, Philips will update the devices to R8.0.4. Philips encourages users to use Philips validated and authorized changes only for the Alice 6 device supported by Philips’ authorized personnel, or under Philips’ explicit published directions for patches, updates, or releases.
Click to expand...

ronjor · Dec 18, 2018

ABB GATE-E2

Original release date: December 18, 2018
Vulnerabilities: Missing Authentication for Critical Function, Cross-site Scripting
4. MITIGATIONS
ABB will not be releasing updated firmware, as both GATE-E1 and GATE-E2 have reached end of life (EOL). ABB recommends implementing defense-in-depth principles to minimize the risk that vulnerabilities are exploited.
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches