The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Oct 8, 2019

Siemens SIMATIC IT UADM

Original release date: October 08, 2019
Vulnerability: Inadequate Encryption Strength
4. MITIGATIONS
Siemens recommends users update to Version 1.3, which can be obtained from a Siemens account manager.
Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
Click to expand...

ronjor · Oct 10, 2019

Siemens PROFINET Devices

Original release date: October 10, 2019
Vulnerability: Uncontrolled Resource Consumption
4. MITIGATIONS
Siemens recommends users update the following PROFINET devices:
Click to expand...

ronjor · Oct 10, 2019

Siemens Industrial Real-Time (IRT) Devices

Original release date: October 10, 2019
Vulnerability: Improper Input Validation
4. MITIGATIONS
Siemens has provided firmware updates for the following products to fix the vulnerability:
Click to expand...

ronjor · Oct 10, 2019

Interpeak IPnet TCP/IP Stack (Update B)

Original release date: October 10, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSMA-19-274-01 Interpeak IPnet TCP/IP Stack (Update A) that was published October 3, 2019, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Oct 10, 2019

Interpeak IPnet TCP/IP Stack (Update A)

Original release date: October 10, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-274-01 Interpeak IPnet TCP/IP Stack that was published October 3, 2019, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Oct 10, 2019

Siemens SIMATIC WinCC and PCS7 (Update C)

Original release date: October 10, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-19-192-02 Siemens SIMATIC WinCC and PCS7 (Update B) that was published September 10, 2019, on the ICS webpage of us-cert.gov.
Click to expand...

ronjor · Oct 10, 2019

Siemens SIMATIC PCS7, WinCC, TIA Portal (Update D)

Original release date: October 10, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-19-134-08 Siemens SIMATIC PCS7, WinCC, TIA Portal (Update C) that was published September 10, 2019, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Oct 10, 2019

ICS Medical Advisory (ICSMA-18-123-01)

Original release date: October 10, 2019
Philips Brilliance Computed Tomography (CT) System (Update A)
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSMA-18-123-01 Philips’ Brilliance Computed Tomography (CT) System that was published May 3, 2018, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Oct 10, 2019

Siemens Industrial Products Local Privilege Escalation Vulnerability (Update I)

Original release date: October 10, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-16-313-02 Siemens Industrial Products Local Privilege Escalation Vulnerability (Update H) that was published June 14, 2018, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Oct 17, 2019

AVEVA Vijeo Citect and Citect SCADA

Original release date: October 17, 2019
Vulnerability: Stack-based Buffer Overflow
4. MITIGATIONS
Vijeo Citect and Citect SCADA users using the IEC870IP driver v4.14.02 and prior are affected and should upgrade to the IEC870IP driver v4.15.00 (sign in required) as soon as possible.
For addition information please see AVEVA Security Bulletin LFSEC00000139.
Click to expand...

ronjor · Oct 17, 2019

Horner Automation Cscape

Original release date: October 17, 2019
Vulnerabilities: Improper Input Validation, Out-of-bounds Write
4. MITIGATIONS
Horner Automation recommends affected users update to Cscape Version 9.90 SP1 or later, which is available for download at:
Click to expand...

ronjor · Oct 22, 2019

Schneider Electric ProClima

Original release date: October 22, 2019
Vulnerabilities: Code Injection, Improper Restriction of Operations within the Bounds of a Memory Buffer, Uncontrolled Search Path Element
4. MITIGATIONS
Schneider Electric has released Version 8.0.0 of ProClima and recommends users upgrade to this version or newer. Users may find the new version at the following location on the Schneider Electric website:
Click to expand...

ronjor · Oct 24, 2019

Honeywell IP-AK2

Original release date: October 24, 2019
Vulnerability: Missing Authentication for Critical Function
4. MITIGATIONS
Honeywell released new firmware Version 1.04.15 and recommends affected users contact Honeywell customer support to resolve the issue.
Honeywell recommends users take the following defensive measures:
Click to expand...

ronjor · Oct 24, 2019

Rittal Chiller SK 3232-Series

Original release date: October 24, 2019
Vulnerabilities: Missing Authentication for Critical Function, Use of Hard-coded Credentials
4. MITIGATIONS
For information on mitigating these vulnerabilities contact Rittal Support by email at: info@rittal.de
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Oct 24, 2019

ICS Medical Advisory (ICSMA-19-297-01)

Philips IntelliSpace Perinatal
Original release date: October 24, 2019
Vulnerability: Exposure of Resource to Wrong Sphere
4. MITIGATIONS
Philips has identified the following guidance and controlling risk mitigations:
Click to expand...

ronjor · Oct 24, 2019

Moxa IKS, EDS (Update A)

Original release date: October 24, 2019
Vulnerabilities: Classic Buffer Overflow, Cross-site Request Forgery, Cross-site Scripting, Improper Access Controls, Improper Restriction of Excessive Authentication Attempts, Missing Encryption of Sensitive Data, Out-of-bounds Read, Unprotected Storage of Credentials, Predictable from Observable State, Uncontrolled Resource Consumption
5. MITIGATIONS

--------- Begin Update A Part 3 of 3 ---------

Moxa recommends users implement the following measures to mitigate these vulnerabilities.
Click to expand...

ronjor · Oct 29, 2019

PHOENIX CONTACT Automation Worx Software Suite

Original release date: October 29, 2019
Vulnerability: Improper Input Validation
4. MITIGATIONS
Phoenix Contact is in the process of developing an updated version of this product. Prior to receiving the updated version, Phoenix Contact strongly recommends users exchange project files using only secure file exchange services, and that project files should not be exchanged via unencrypted email.
Click to expand...

ronjor · Oct 31, 2019

Advantech WISE-PaaS/RMM

Original release date: October 31, 2019
Vulnerabilities: Path Traversal, Missing Authorization, Improper Restriction of XML External Entity Reference, SQL Injection
4. MITIGATIONS
Advantech phased out WISE-PaaS/RMM in July of 2019 and replaced this product with EdgeSense and DeviceOn. Advantech has provided notification to their PSM’s, sales managers, RSM’s and partners of the phase out to replace the old WISE-PaaS/RMM software bundle with EdgeSense and DeviceOn.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Click to expand...

ronjor · Oct 31, 2019

Honeywell equIP Series IP Cameras

Original release date: October 31, 2019
Vulnerability: Improper Input Validation
4. MITIGATIONS
Honeywell has released firmware update packages for all affected products listed above. The package can be downloaded from:
Click to expand...

ronjor · Oct 31, 2019

Honeywell equIP and Performance Series IP Cameras

Original release date: October 31, 2019
Vulnerability: Missing Authentication for Critical Function
4. MITIGATIONS
Honeywell has released firmware update packages for all affected products. The package can be downloaded from:
Click to expand...

ronjor · Oct 31, 2019

Honeywell equIP and Performance Series IP Cameras and Recorders

Original release date: October 31, 2019
Vulnerability: Authentication Bypass by Capture-Replay
4. MITIGATIONS
Honeywell has released firmware update packages for all affected products listed above. The package can be downloaded from:
Click to expand...

ronjor · Nov 5, 2019

Omron Network Configurator for DeviceNet (Update A)

Original release date: November 05, 2019
Vulnerability: Untrusted Search Path
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-134-01 Omron Network Configurator for DeviceNet that was published May 14, 2019, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Nov 5, 2019

ICS Medical Advisory (ICSMA-19-274-01)
Interpeak IPnet TCP/IP Stack (Update C)

Original release date: November 05, 2019
Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Integer Underflow, Improper Restriction of Operations within the Bounds of a Memory Buffer, Race Condition, Argument Injection, Null Pointer Dereference
2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSMA-19-274-01 Interpeak IPnet TCP/IP Stack (Update B) published October 10, 2019, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Nov 5, 2019

Omron CX-Supervisor

Original release date: November 05, 2019
Vulnerability: Use of Obsolete Function
4. MITIGATIONS
Omron recommends users update to CX-Supervisor 3.51 (9). The following link contains Omron’s explanation for the changes and instructions to obtain the update
Click to expand...

:

ronjor · Nov 7, 2019

ICS Medical Advisory (ICSMA-19-120-01)

Philips Tasy EMR (Update A)
Original release date: November 07, 2019
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSMA-19-120-01 Philips Tasy EMR that was published April 30, 2019, on the ICS webpage on us-cert.gov.
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches