Cybersecurity

CISA has published an advisory on a use of hard-coded cryptographic key vulnerability in Siemens SIMATIC IT Unified Architecture Discrete Manufacturing (UADM). All versions prior to 1.3 are affected. Successful exploitation of this vulnerability could allow an attacker to gain read and write access to the related TeamCenter station. Siemens recommends users update to Version 1.3. CISA also recommends a series of measures for mitigating the vulnerability. Read the advisory at CISA.

CISA has published an advisory on a cross-site request forgery vulnerability in SMA Solar Technology AG Sunny WebBox. Versions 1.6 and prior are affected. Successful exploitation of this vulnerability could allow an attacker to generate a denial-of-service condition, modify passwords, enable services, achieve man-in-the-middle, and modify input parameters associated with devices such as sensors. This product is end-of-life and is no longer supported, but SMA has provided recommendations for mitigating the vulnerability.

Microsoft warns that it has observed an Iranian group – referred to as “Phosphorus” – attempting to take control of email accounts by exploiting the password reset or account recovery features. According to Microsoft, Phosphorus used information gathered from researching their targets or other means to game password reset or account recovery features and attempt to take over some targeted accounts.

The US National Security Agency (NSA) and the UK National Cyber Security Centre (NCSC) have released advisories on advanced persistent threat (APT) actors exploiting multiple vulnerabilities in Virtual Private Network (VPN) applications, specifically those produced by Pulse Connect Secure, Fortinet, and Palo Alto Networks. According to the advisories, a remote attacker could exploit these vulnerabilities to take control of an affected system.