The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Dec 18, 2018

Advantech WebAccess/SCADA

Original release date: December 18, 2018
Vulnerability: Improper Input Validation
4. MITIGATIONS
Advantech has released Version 8.3.4 of WebAccess/SCADA to address the reported vulnerability. Users can download the latest version of WebAccess/SCADA at the following location (registration required):
Click to expand...

ronjor · Dec 18, 2018

3S-Smart Software Solutions GmbH CODESYS Control V3 Products

Original release date: December 18, 2018
Vulnerability: Improper Access Control
4. MITIGATIONS
3S-Smart Software Solutions GmbH recommends activating the CODESYS Control online user management and encryption of the online communication.
3S-Smart Software Solutions GmbH recommends updating to the latest software Version 3.5.14.0 or newer. The new software can be downloaded at the following location:
Click to expand...

ronjor · Dec 18, 2018

3S-Smart Software Solutions GmbH CODESYS V3 Products

Original release date: December 18, 2018
Vulnerabilities: Use of Insufficiently Random Values, Improper Restriction of Communication Channel to Intended Endpoints
4. MITIGATIONS
3-S Smart Software Solutions GmbH has released a new version of the software that can be downloaded from:
Click to expand...

ronjor · Dec 18, 2018

Siemens TIM 1531 IRC Modules

Original release date: December 18, 2018
Vulnerability: Missing Authentication for Critical Function
4. MITIGATIONS
Siemens recommends upgrading to firmware v2.0, which can be downloaded from the following link:
Click to expand...

ronjor · Dec 18, 2018

ABB CMS-770

Original release date: December 18, 2018
Vulnerabilities: Improper Authentication
4. MITIGATIONS
ABB recommends installing the device in accordance with the latest instructions from the updated technical manual. For additional information, refer to ABB’s security notification ABBVU-EPBP-R-5673 and the product user manual.
Click to expand...

ronjor · Dec 18, 2018

ABB M2M ETHERNET

Original release date: December 18, 2018
Vulnerability: Improper Authentication
4. MITIGATIONS
ABB recommends installing the device in accordance with the latest instructions from the updated technical manual. For additional information, refer to ABB’s security notification ABBVU-EPBP-R-5672.
Click to expand...

ronjor · Dec 18, 2018

Schneider Electric Triconex Tricon (Update B)

Original release date: April 17, 2018 | Last revised: December 18, 2018
Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer
5. MITIGATIONS
--------- Begin Update B Part 1 of 1 --------
5.1 VENDOR RECOMMENDATION
Schneider Electric has released the following security notification:
Click to expand...

ronjor · Dec 20, 2018

Horner Automation Cscape

Original release date: December 20, 2018
Vulnerability: Improper Input Validation
4. MITIGATIONS
Horner Automation states that only the Cscape programming software is affected. The operation of any OCS device programmed with an affected version of Cscape is not compromised.
Horner Automation recommends affected users update to the latest version of Cscape (Version 9.80 SP4), which is available for download at:
Click to expand...

ronjor · Dec 20, 2018

Schneider Electric EcoStruxure

Original release date: December 20, 2018
Vulnerability: Open Redirect
4. MITIGATIONS
Schneider Electric recommends upgrading to the versions listed below, which include fixes for the reported vulnerability:
Click to expand...

ronjor · Dec 20, 2018

Rockwell Automation FactoryTalk Services Platform

Original release date: December 20, 2018
Vulnerability: Heap-based Buffer Overflow
5. MITIGATIONS
Rockwell Automation recommends that affected users update to the latest version of the application. The latest version can be found at the following link:
Click to expand...

ronjor · Dec 20, 2018

Omron CX-Supervisor (Update A)

Original release date: March 13, 2018 | Last revised: December 20, 2018
Vulnerabilities: Stack-based Buffer Overflow, Use After Free, Access of Uninitialized Pointer, Double Free, Out-of-bounds Write, Untrusted Pointer Dereference, Heap-based Buffer Overflow.
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-072-01 Omron CX-Supervisor that was published March 13, 2018, on the NCCIC/ICS-CERT website.
5. MITIGATIONS
Omron has released Version 3.4.1 of CX-Supervisor to address the reported vulnerabilities. Users can download the latest version of CX-Supervisor at the following location:
Click to expand...

ronjor · Jan 3, 2019

Schneider Electric Pro-face GP-Pro EX

Original release date: January 03, 2019
Vulnerability: Improper Input Validation
4. MITIGATIONS
Schneider Electric has produced Version 4.08.200 of the software. It can be downloaded from:
Click to expand...

ronjor · Jan 3, 2019

Yokogawa Vnet/IP Open Communication Driver

Original release date: January 03, 2019
Vulnerability: Resource Management Error
4. MITIGATIONS
Yokogawa recommends users of affected devices and versions update to the latest available release.
Click to expand...

ronjor · Jan 3, 2019

Hetronic Nova-M

Original release date: January 03, 2019
Vulnerability: Authentication Bypass by Capture-Replay
4. MITIGATIONS
Hetronic recommends that all Nova-M users update their radio transmitters to firmware version r161 and their receivers to the following versions:
Click to expand...

ronjor · Jan 8, 2019

Schneider Electric Zelio Soft 2

Original release date: January 08, 2019
Vulnerability: Use After Free
4. MITIGATIONS
Schneider Electric has released Version 5.2 of the affected software, available for download at:
Click to expand...

ronjor · Jan 8, 2019

Schneider Electric IIoT Monitor

Original release date: January 08, 2019
Vulnerabilities: Path Traversal, Unrestricted Upload of File with Dangerous Type, XXE
4. MITIGATIONS
Schneider Electric recommends that affected users contact Schneider Electric customer support at https://www.schneider-electric.com/en/work/support/contacts.jsp for assistance in migrating to the latest software to resolve the issues
Click to expand...

.

ronjor · Jan 9, 2019

Schneider Electric U.motion Builder (Update A)

Original release date: June 29, 2017 | Last revised: January 08, 2019
Vulnerabilities: SQL Injection, Path Traversal, Improper Authentication, Use of Hard-Coded Password, Improper Access Control, Denial of Service, Information Disclosure
MITIGATION
Schneider Electric says a firmware update, which includes fixes for these vulnerabilities, is scheduled for availability to download by the end of August. When available, it is highly recommended that U.motion Builder users apply the patch in a timely manner.
Schneider Electric’s security notice SEVD-2017-178-01 is available at the following location:
Click to expand...

ronjor · Jan 10, 2019

Emerson DeltaV

Original release date: January 10, 2019
Vulnerability: Authentication Bypass
4. MITIGATIONS
Emerson recommends users to patch affected products listed below:
DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, and R6
Click to expand...

ronjor · Jan 10, 2019

Schneider Electric Modicon M340 PLC (Update A)

Original release date: February 23, 2017 | Last revised: January 10, 2019
Vulnerability: Resource Exhaustion
5. MITIGATIONS
--------- Begin Update A Part 3 of 3 --------
Schneider Electric has released fixes for the vulnerability that can be downloaded from:
Click to expand...

ronjor · Jan 10, 2019

Tridium Niagara Enterprise Security, Niagara AX, and Niagara 4

Original release date: January 10, 2019
Vulnerability: Cross-site Scripting
5. MITIGATIONS
Tridium recommends that affected users upgrade to the latest versions of the software (login required).
Click to expand...

ronjor · Jan 10, 2019

Pilz PNOZmulti Configurator

Original release date: January 10, 2019
Vulnerability: Clear-text Storage of Sensitive Information
4. MITIGATIONS
Pilz has discontinued the PMI m107 diag HMI device and the function concerned was removed in PNOZmulti Configurator Version 10.9.
Pilz recommends the following mitigations depending on use of the PMI m107 diag HMI device:
Click to expand...

ronjor · Jan 15, 2019

LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA

Original release date: January 15, 2019
Vulnerabilities: Improper Input Validation, Out-of-Bounds Read, Code Injection, Untrusted Pointer Dereference, Out-of-Bounds Write, Relative Path Traversal, Injection, Use of Hard-Coded Credentials, Authentication Bypass Using an Alternate Path or Channel
4. MITIGATIONS
LCDS recommends users update to Version 4.1.0.4150 which can be found at the following location:
Click to expand...

ronjor · Jan 15, 2019

Schneider Electric IIoT Monitor (Update A)

Original release date: January 08, 2019 | Last revised: January 15, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-008-02 Schneider Electric IIoT Monitor that was published January 08, 2019, on the NCCIC/ICS-CERT website.
5. MITIGATIONS
Schneider Electric recommends that affected users contact Schneider Electric customer support at https://www.schneider-electric.com/en/work/support/contacts.jsp for assistance in migrating to the latest software to resolve the issues.
Click to expand...

ronjor · Jan 17, 2019

Omron CX-Supervisor

Original release date: January 17, 2019
Vulnerabilities: Code Injection, Command Injection, Use After Free, Type Confusion
4. MITIGATIONS
Omron has released Version 3.5.0.11 of CX-Supervisor to address the reported vulnerabilities. To be protected, development projects must be upgraded and saved in the new format, then rebuilt in the latest 3.5.0.11 format. Information on downloading the latest version of CX-Supervisor can be found at the following location:
Click to expand...

ronjor · Jan 17, 2019

ABB CP400 Panel Builder TextEditor 2.0

Original release date: January 17, 2019
Vulnerability: Improper Input Validation
4. MITIGATIONS
ABB recommends users of affected Versions 2.0.7.05 and prior update to the latest Version 2.1.7.21, which can be requested at the following location:
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches