The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Feb 19, 2019

Horner Automation Cscape

Original release date: February 19, 2019
Vulnerability: Improper Input Validation
4. MITIGATIONS
Horner Automation recommends affected users update to the latest version of Cscape (Version 9.90), which is available for download at the following links:
Click to expand...

ronjor · Feb 19, 2019

Rockwell Automation Allen-Bradley PowerMonitor 1000

Original release date: February 19, 2019
Vulnerabilities: Cross-site Scripting and Authentication Bypass
4. MITIGATIONS
Rockwell Automation is currently working on mitigations and reports that CheckPoint Software Technologies has released IPS rules to detect attempts to exploit CVE-2019-19615.
For more information, Rockwell Automation has released a security notification that can be found at (login required):
Click to expand...

ronjor · Feb 21, 2019

Wind River VxWorks SSH and Web Server and General Electric D20MX (Update A)

Original release date: April 01, 2013 | Last revised: February 21, 2019
ATTENTION: Exploitable remotely/low skill level to exploit
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-13-091-01 Wind River VxWorks SSH and Web Server that was published April 1, 2013, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Feb 26, 2019

Moxa IKS, EDS

Original release date: February 26, 2019
Vulnerabilities: Classic Buffer Overflow, Cross-site Request Forgery, Cross-site Scripting, Improper Access Controls, Improper Restriction of Excessive Authentication Attempts, Missing Encryption of Sensitive Data, Out-of-bounds Read, Unprotected Storage of Credentials, Predictable from Observable State, Uncontrolled Resource Consumption
4. MITIGATIONS
Moxa recommends that users implement the following measures to mitigate these vulnerabilities.
Install firmware patch. Patches may be requested from Moxa Customer Service at the following link (login required):
Click to expand...

ronjor · Feb 28, 2019

PSI GridConnect Telecontrol

Original release date: February 28, 2019
Vulnerability: Cross-site Scripting
4. MITIGATIONS
PSI recommends users of affected devices update their devices to a version where this vulnerability is patched.
Click to expand...

ronjor · Feb 28, 2019

Kunbus PR100088 Modbus Gateway (Update B)

Original release date: February 05, 2019 | Last revised: February 28, 2019
Vulnerabilities: Improper Authentication, Information Exposure Through Query Strings in GET Request, Missing Authentication for Critical Function, Improper Input Validation, Cleartext Storage of Sensitive Information
2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-19-036-05 (Update A) Kunbus PR100088 Modbus Gateway that was published February 7, 2019, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 5, 2019

Rockwell Automation RSLinx Classic

Original release date: March 05, 2019
Vulnerability: Stack-based Buffer Overflow
4. MITIGATIONS
Rockwell Automation has released patches to address earlier versions of RSLinx Classic including v3.60, v3.70, v3.80, v3.81, v3.90, v4.00.01, v4.10. These patches can be found at Knowledgebase Article ID: 1084828
Click to expand...

ronjor · Mar 5, 2019

IDenticard PremiSys (Update A)

Original release date: January 31, 2019 | Last revised: March 05, 2019
Vulnerabilities: Use of Hard-coded Credentials, Use of Hard-coded Password, Inadequate Encryption Strength
5. MITIGATIONS
--------- Begin Update A Part 2 of 2 ---------
IDenticard recommends users upgrade to Version 4.2 to address all three vulnerabilities. This software update is provided free of charge.
In addition to upgrading to Version 4.2, CVE-2019-3908 requires users to set a new password for the backup/restore feature. For more information see the following link:
Click to expand...

guest · Mar 6, 2019

Triton is the world’s most murderous malware, and it’s spreading
March 5, 2019
https://www.technologyreview.com/s/613054/cybersecurity-critical-infrastructure-triton-malware/

But when the Australian security consultant was summoned to a petrochemical plant in Saudi Arabia in the summer of 2017, what he found made his blood run cold.
In attacking the plant, the hackers crossed a terrifying Rubicon. This was the first time the cybersecurity world had seen code deliberately designed to put lives at risk.

But the rise of nation-state hackers with the time, money, and motivation to target critical infrastructure, as well as the increasing use of internet-connected systems, means the past may well not be a reliable guide to the future.

[...] Triton is a reminder that the risks are increasing. Gutmanis thinks more attacks using the world’s most murderous malware are all but inevitable. “While this was the first,” he says, “I’d be surprised if it turns out to be the last.”
Click to expand...

guest · Mar 11, 2019

Just a reminder: We're still bad at securing industrial controllers
Moxa boxes caught using plain text passwords and insecure web apps
March 11, 2019
https://www.theregister.co.uk/2019/03/11/industrial_controllers/

Bug hunters have discovered yet another set of flaws in industrial control systems used by electric utilities, oil and gas companies, and shipping and transportation providers.
The Positive Technologies trio of Ivan Boyko, Vyacheslav Moskvin, and Sergey Fedonin were credited with sussing out and reporting a series of 12 different security vulnerabilities in controllers from Moxa.

“A vulnerable switch can mean the compromise of the entire industrial network," Paolo Emiliani, Positive's analyst for Industry and SCADA research, said today.
For most of the flaws, Moxa is recommending customers update their firmware to the latest version, though there are other steps that will need to be taken to close up all of the holes.
Click to expand...

ronjor · Mar 12, 2019

WIBU SYSTEMS AG WibuKey Digital Rights Management (Update B)

Original release date: March 12, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-19-043-03 Siemens Licensing Software for SICAM 230 (Update A) that was published February 14, 2019, on the NCCIC/ICS-CERT website. This advisory includes mitigations for information exposure, out-of-bounds write, and heap-based buffer overflow vulnerabilities in WIBU-SYSTEMS WibuKey digital rights management software.
Click to expand...

ronjor · Mar 13, 2019

Siemens Industrial Products (Update M)

Original release date: December 05, 2017 | Last revised: March 12, 2019
Vulnerability: Improper Input Validation
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-339-01 Siemens Industrial Products (Update L) published February 12, 2019, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 13, 2019

Siemens SINUMERIK Controllers (Update A)

Original release date: December 11, 2018 | Last revised: March 12, 2019
Vulnerabilities: Heap-based Buffer Overflow, Integer Overflow or Wraparound, Protection Mechanism Failure, Permissions, Privileges, and Access Controls, Stack-based Buffer Overflow, Uncaught Exception
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-345-02 Siemens SINUMERIK Controllers that was published December 11, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 13, 2019

Siemens SIMATIC S7 (Update A)

Original release date: November 13, 2018 | Last revised: March 12, 2019
Vulnerability: Resource Exhaustion
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-317-05 Siemens SIMATIC S7 that was published November 13, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 13, 2019

Siemens SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, and SIMATIC NET PC Software (Update G)

Original release date: March 29, 2018 | Last revised: March 12, 2019
Vulnerability: Improper Input Validation
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-18-088-03 Siemens SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, and SIMATIC NET PC Software (Update F) that was published February 5, 2019, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 13, 2019

Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module (Update C)

Original release date: March 08, 2018 | Last revised: March 12, 2019
Vulnerabilities: Missing Authentication for Critical Function, Inadequate Encryption Strength
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-18-067-01 Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module (Update B) that was published May 17, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 13, 2019

Siemens Desigo PXC (Update C)

Original release date: January 25, 2018 | Last revised: March 12, 2019
Vulnerability: Improper Authentication
2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-18-025-02B Siemens Desigo PXC that was published March 22, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 14, 2019

LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA ELS Files

Original release date: March 14, 2019
Vulnerability: Out-of-Bounds Write
4. MITIGATIONS
LCDS recommends users update to Version 4.3.1.71, which can be found at the following location:
Click to expand...

ronjor · Mar 14, 2019

Gemalto Sentinel UltraPro

Original release date: March 14, 2019
Vulnerability: Uncontrolled Search Path Element
4. MITIGATIONS
Users who have Sentinel UltraPro Client Library ux32w.versions v1.3.0, v1.3.1 or v1.3.2 are advised to upgrade to Sentinel UtraPro v1.3.3 in order to enable this security update. The security update is found at the following link:
Click to expand...

ronjor · Mar 14, 2019

PEPPERL+FUCHS WirelessHART-Gateways

Original release date: March 14, 2019
Vulnerability: Path Traversal
4. MITIGATIONS
PEPPERL+FUCHS reports that affected users with WHA-GW-*-ETH devices should upgrade to firmware Version 03.00.08. Affected users with WHA-GW-*-ETH.EIP devices should upgrade to firmware Version 02.00.01
Click to expand...

ronjor · Mar 19, 2019

Columbia Weather Systems MicroServer

Original release date: March 19, 2019
Vulnerabilities: Cross-site Scripting, Path Traversal, Improper Authentication, Improper Input Validation, Code Injection
4. MITIGATIONS
Columbia Weather Systems has released a firmware update, Version: MS_2.7.9973, that addresses all the above vulnerabilities found on the Weather MicroServer.
Click to expand...

ronjor · Mar 19, 2019

AVEVA InduSoft Web Studio and InTouch Edge HMI

Original release date: March 19, 2019
Vulnerability: Uncontrolled Search Path Element
4. MITIGATIONS
AVEVA recommends that users upgrade to the latest versions located the following links:
Click to expand...

guest · Mar 20, 2019

Want Some Free Industrial Control System Security Tools?
March 19, 2019
https://www.cbronline.com/news/industrial-cybersecurity-dragos

Industrial cybersecurity company Dragos Inc. has released two industrial control system (ICS) asset discovery tools for free. The two, Cyberlens and Integrity, were previously commercial products.

They can provide industrial asset identification, ICS network and data flow visualization with basic deep packet inspection of major ICS protocols like ModbusTCP, DNP3, EthernetIP, BacNet, and OPC UA.
The releases come after the Maryland-based company bought industry rival NexDefense for an undisclosed sum this week, and comprise tools developed by both Dragos and NexDefense respectively.
Industrial Cybersecurity: Free Releases May Prove Useful for Smaller Businesses
“Most enterprise level software are too costly for small businesses and municipalities to afford even at the basic level. The acquisition of NexDefense and the release of CyberLens and Integrity, both built for ICS networks, will help the community perform the basic tasks of identifying assets”, Dragos said in a blog published Monday.
Click to expand...

ronjor · Mar 21, 2019

Medtronic Conexus Radio Frequency Telemetry Protocol

Original release date: March 21, 2019
Vulnerabilities: Improper Access Control, Cleartext Transmission of Sensitive Information
4. MITIGATIONS
Medtronic has applied additional controls for monitoring and responding to improper use of the Conexus telemetry protocol by the affected implanted cardiac devices. Additional mitigations are being developed and will be deployed through future updates, assuming regulatory approval.
Medtronic recommends that users take additional defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Click to expand...

ronjor · Mar 26, 2019

Siemens SCALANCE X

Original release date: March 26, 2019
Vulnerability: Expected Behavior Violation
4. MITIGATIONS
Siemens has identified the following specific workaround/mitigation that users can implement to reduce the risk associated with this vulnerability in SCALANCE XP/XC/XF-200:
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

Useful Searches