December 12, 2019
CISA has updated this advisory with additional details on the affected products and the location of additional details of the vulnerability. Read the advisory at CISA.
April 16, 2019
Whether by taking advantage of retailers’ discounts or through gifting from family members or friends, many people will be the recipients of new cyber gadgets by the end of the present holiday season. Many of these people, in turn, will take these devices (particularly the mobiles ones) into their workplaces, potentially transferring any vulnerabilities they may have to their organizations. With this consideration in mind, WaterISAC encourages its members to review list of ten tips for securely configuring new devices from its partner, MS-ISAC.
CISA has published an advisory on use of a broken or risky cryptographic algorithm and missing support for integrity check vulnerabilities in Siemens S7-1200 and S7-1500 CPU Families. Multiple versions of multiple products are affected. Successful exploitation of these vulnerabilities may allow an attacker to modify network traffic or impact the perceived integrity of the user program stored on the CPU. Siemens has released updates for some of the products and recommends users update to the new versions.
CISA has published an advisory on cross-site request forgery, improper neutralization of script-related HTML tags in a web page, and improper input validation vulnerabilities in Siemens XHQ Operations Intelligence products. All versions of the product are affected. Successful exploitation of these vulnerabilities could allow an attacker to read or modify contents of the web application. Siemens recommends users update XHQ Operations Intelligence product line to v6.0.0.2 or later. CISA also recommends a series of measures to mitigate the vulnerability.
CISA has published an advisory on improper restriction of operations within the bounds of a memory buffer and resource management errors vulnerabilities in Siemens RUGGEDCOM ROS. All versions of multiple products are affected. Successful exploitation of these vulnerabilities could allow a denial-of-service condition or arbitrary code execution. Siemens has identified specific workarounds and mitigations users can apply to reduce the risk. CISA also recommends a series of measures to mitigate the vulnerabilities.
CISA has published an advisory on cleartext storage of sensitive information in GUI, improper authentication, relative path traversal, missing authentication for critical function, weak cryptography for passwords, and exposed dangerous method or function vulnerabilities in Siemens SiNVR. All versions of SiNVR Central Control Server and Video Server are affected.
CISA has published an advisory on an improper enforcement of message integrity during transmission in a communication channel vulnerability in Siemens SCALANCE W700 and W1700. For SCALANCE W700, versions 6.3 and prior are affected. For SCALANCE W1700, versions 1.0 and prior are affected. Successful exploitation of this vulnerability could allow an attacker to access confidential data. Siemens recommends installing the following software updates to address this vulnerability. CISA also recommends a series of measures to mitigate the vulnerability.
U.S. Department of Homeland Security (DHS) officials are said to have selected Bryan S. Ware to be the assistant secretary for cybersecurity at the Cybersecurity and Infrastructure Security Agency (CISA), which would make him DHS’s most senior official focused exclusively on cybersecurity.
Earlier this year, a Microsoft team scanned all customer accounts and found that 44 million users were employing usernames and passwords that leaked online following security breaches at other online services. Microsoft said it scanned user accounts using a database of over three billion leaked credentials, which it obtained from multiple sources, such as law enforcement and public databases. The 44 million total included Microsoft Services Accounts (regular user accounts), but also Azure AD accounts. "For the leaked credentials for which we found a match, we force a password reset.
The FBI said it has found no signs of any link between a cyber attack on the computer systems for the city of Pensacola, Florida and the attack at the local Naval Air Station in which three sailors were killed and eight others were wounded. The city became aware of the cyber attack early Saturday, just hours after the shooting at the Pensacola Naval Air Station that occurred on Friday. City officials expressed uncertainty over whether the incidents were related but reached out federal authorities as a precaution.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
