The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Jun 23, 2020

ICS Medical Advisory (ICSMA-20-170-04)
Baxter Sigma Spectrum Infusion Pumps (Update A)
Original release date: June 23, 2020

Vulnerabilities: Use of Hard-coded Password, Cleartext Transmission of Sensitive Data, Incorrect Permission Assignment for Critical Resource, Operation on a Resource After Expiration or Release
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-170-04 Sigma Spectrum Infusion Pumps that was published June 18, 2020, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jun 23, 2020

ICS Medical Advisory (ICSMA-20-170-03)
Baxter Phoenix Hemodialysis Delivery System (Update A)
Original release date: June 23, 2020

Vulnerability: Cleartext Transmission of Sensitive Information
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-170-03 Baxter Phoenix Hemodialysis Delivery System that was published June 18, 2020, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jun 23, 2020

ICS Medical Advisory (ICSMA-20-170-02)
Baxter PrismaFlex and PrisMax (Update A)
Original release date: June 23, 2020

Vulnerabilities: Cleartext Transmission of Sensitive Information, Improper Authentication, Use of Hard-Coded Password
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-170-01 Baxter PrismaFlex and PrisMax that was published June 18, 2020, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jun 23, 2020

Baxter ExactaMix (Update A)
Original release date: June 23, 2020

Vulnerabilities: Use of Hard-coded Password, Cleartext Transmission of Sensitive Data, Missing Encryption of Sensitive Data, Improper Access Control, Exposure of Resource to Wrong Sphere, Improper Input Validation
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-170-01 Baxter ExactaMix that was published June 18, 2020, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jun 23, 2020

ABB Device Library Wizard

Original release date: June 23, 2020
Vulnerability: Insecure Storage of Sensitive Information
4. MITIGATIONS
ABB recommends users apply one of the following updates:
Click to expand...

ronjor · Jun 23, 2020

Honeywell ControlEdge PLC and RTU

Original release date: June 23, 2020
Vulnerabilities: Cleartext Transmission of Sensitive Information
4. MITIGATIONS
Honeywell provided detailed information for mitigation on the insecure communication in Control Edge PLC\RTU. Please access the support document SN2020-04-17-01-ConotrolEdge-PLC-and- and-RTU-Secure-Communication (login required). Download this document and follow the step by step instructions. The user must be logged in to access the security notification.
Users who have difficulty accessing the document can contact Honeywell support
Click to expand...

ronjor · Jun 23, 2020

Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L and FX Series CPU Modules

Original release date: June 23, 2020
Vulnerability: Cleartext Transmission of Sensitive Information
4. MITIGATIONS
Mitsubishi Electric recommends encrypting the communication path by setting up a VPN to mitigate the impact of this vulnerability.
Click to expand...

ronjor · Jun 25, 2020

Rockwell FactoryTalk View SE

Original release date: June 25, 2020
Vulnerabilities: Cleartext Storage of Sensitive Information, Weak Encoding for Password
4. MITIGATIONS
Users of the affected versions of DeskLock provided with FactoryTalk View SE are encouraged to update to an available software version that addresses the associated risk, v10.0 or later. Users who are unable to update are directed towards risk mitigation strategies provided below, and are encouraged, when possible, to combine these with the general security guidelines to employ multiple strategies simultaneously.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Jun 25, 2020

Rockwell FactoryTalk Services Platform XXE

Original release date: June 25, 2020
Vulnerability: Improper Restriction of XML External Entity Reference
4. MITIGATIONS
Affected users are encouraged to use Rockwell Automation Knowledgebase article 25612 to determine if FactoryTalk Services Platform is installed.
For more information please see Rockwell Automation Knowledgebase article 1092746
Click to expand...

ronjor · Jun 25, 2020

ENTTEC Lighting Controllers

Original release date: June 25, 2020
Vulnerabilities: Use of Hard-coded Cryptographic Key, Cross-site Scripting, Improper Access Control, Incorrect Permission Assignment for Critical Resource
4. MITIGATIONS
ENTTEC is looking into these vulnerabilities but has not yet released updated software. They recommend devices should be located behind appropriate firewalls and network controls, and not accessible from the Internet.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Jun 25, 2020

ICS Medical Advisory (ICSMA-20-177-01)
Philips Ultrasound Systems
Original release date: June 25, 2020

Vulnerability: Authentication Bypass Using an Alternate Path or Channel
4. MITIGATIONS
Philips released Ultrasound EPIQ/Affiniti Version VM6.0 in April 2020 and recommends users with the Ultrasound EPIQ/Affiniti systems to contact their local Philips service support team, or regional service support for installation information.
Philips is currently planning the following new releases:
Click to expand...

ronjor · Jun 30, 2020

Delta Industrial Automation DOPSoft

Original release date: June 30, 2020
Vulnerabilities: Out-of-bounds Read, Heap-based Buffer Overflow
4. MITIGATIONS
Delta Electronics is currently planning to release Version 4.00.08.17 (or later) that corrects these vulnerabilities in July 2020.
Delta Electronics recommends affected users restrict the interaction with the application to trusted files until the update is available for release.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Jun 30, 2020

Mitsubishi Electric Factory Automation Engineering Software Products

Original release date: June 30, 2020
Vulnerabilities: Improper Restriction of XML External Entity Reference and Uncontrolled Resource Consumption
4. MITIGATIONS
Mitsubishi Electric recommends that affected users download the latest version of each software product from the following site and update it:
Click to expand...

ronjor · Jun 30, 2020

Treck TCP/IP Stack (Update B)

Original release date: June 18, 2020 | Last revised: June 30, 2020
Vulnerabilities: Improper Handling of Length Parameter Inconsistency, Improper Input Validation, Double Free, Out-of-bounds Read, Integer Overflow or Wraparound, Improper Null Termination, Improper Access Control
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-168-01 Treck TCP/IP Stack that was published June 16, 2020, to the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jun 30, 2020

Inductive Automation Ignition (Update B)

Original release date: June 02, 2020 | Last revised: June 30, 2020
Vulnerabilities: Missing Authentication for Critical Function, Deserialization of Untrusted Data
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-147-01 Inductive Automation Ignition (Update A) that was published June 2, 2020, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jul 2, 2020

ICS Medical Advisory (ICSMA-20-184-01)
OpenClinic GA

Original release date: July 02, 2020
Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Improper Restriction of Excessive Authentication Attempts, Improper Authentication, Missing Authorization, Execution with Unnecessary Privileges, Unrestricted Upload of File with Dangerous Type, Path Traversal, Improper Authorization, Cross-site Scripting, Use of Unmaintained Third-Party Components, Insufficiently Protected Credentials, Hidden Functionality
4. MITIGATIONS
OpenClinic GA is aware of these vulnerabilities but has not provided any confirmation of their resolution. Please upgrade to the latest version to ensure you have all current fixes.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should
Click to expand...

:

ronjor · Jul 2, 2020

Nortek Linear eMerge 50P/5000P

Original release date: July 02, 2020
ulnerabilities: Path Traversal, Command Injection, Unrestricted Upload of File with Dangerous Type, Cross-site Request Forgery, Improper Authentication
4. MITIGATIONS
Nortek has released v32-09a. For more information please contact Nortek customer support.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Jul 2, 2020

ABB System 800xA Information Manager

Original release date: July 02, 2020
Vulnerability: Cross-site Scripting
4. MITIGATIONS
ABB’s recommendations:
This vulnerability was corrected in System 800xA of the following versions:
Click to expand...

ronjor · Jul 2, 2020

Johnson Controls exacqVision (Update A)

Original release date: June 18, 2020 | Last revised: July 02, 2020
Vulnerability: Improper Verification of Cryptographic Signature
4. MITIGATIONS
Johnson Controls recommends the following mitigations:
Click to expand...

ronjor · Jul 7, 2020

Grundfos CIM 500

Original release date: July 07, 2020
Vulnerabilities: Missing Authentication for Critical Function, Unprotected Storage of Credentials
4. MITIGATIONS
Grundfos recommends updating to firmware v06.16.00 and to change user credentials after updating.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Jul 7, 2020

Mitsubishi Electric GOT2000 Series

Original release date: July 07, 2020
Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Session Fixation, NULL Pointer Dereference, Improper Access Control, Argument Injection, Resource Management Errors
4. MITIGATIONS
Mitsubishi recommends users follow the steps below to update CoreOS to the latest version:
Install the MELSOFT GT Designer3 (2000) Version 1.240A or later on your personal computer.
Start the MELSOFT GT Designer3 and copy CoreOS of Version -Z or later to SD card.
Insert the SD card removed from the personal computer to the target products and update to the latest version of CoreOS.
Please contact your local Mitsubishi sales office about MELSOFT GT Designer3 (2000).
Click to expand...

ronjor · Jul 7, 2020

Treck TCP/IP Stack (Update C)

Original release date: June 18, 2020 | Last revised: July 07, 2020
Vulnerabilities: Improper Handling of Length Parameter Inconsistency, Improper Input Validation, Double Free, Out-of-bounds Read, Integer Overflow or Wraparound, Improper Null Termination, Improper Access Control
CISA is aware of a public report, known as “Ripple20” that details vulnerabilities found in the Treck TCP/IP stack. CISA is issuing this advisory to provide early notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-168-01 Treck TCP/IP Stack (Update B) that was published June 30, 2020, to the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jul 7, 2020

Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L and FX Series CPU Modules (Update A)

Original release date: June 23, 2020 | Last revised: July 07, 2020
Vulnerability: Cleartext Transmission of Sensitive Information
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-20-175-01 Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L and FX Series CPU Modules that was published June 23, 2020, on the ICS webpage on us-cert.gov.
Click to expand...

ronjor · Jul 9, 2020

Phoenix Contact Automation Worx Software Suite

Original release date: July 09, 2020
Vulnerabilities: Stack-based Buffer Overflow, Out-of-Bounds Read
4. MITIGATIONS
Phoenix Contact recommends users exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email. In addition, we recommend exchanging or storing project files together with a checksum to ensure their integrity.
With the next version of Automation Worx Software Suite, a sharpened input data validation, with respect to buffer size and description of size and number of objects referenced in a file, will be implemented.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

ronjor · Jul 9, 2020

Rockwell Automation Logix Designer Studio 5000

Original release date: July 09, 2020
Vulnerability: Improper Restriction of XML External Entity Reference
4. MITIGATIONS
Rockwell Automation recommends that affected users of the AML or RDF files should not accept files from unknown sources and remain cautious of social engineering attempts that may take advantage of this vulnerability.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches