Cybersecurity

CISA has released an advisory on an information exposure vulnerability in Honeywell Performance IP Cameras and Performance NVRs. Numerous products and versions of the products are affected. Successful exploitation of this vulnerability could allow an attacker to view device configuration information. Honeywell has released firmware update packages for all affected products.  CISA also recommends a series of measures to mitigate the vulnerability. Read the advisory at CISA.

CISA has released an advisory on code injection, command injection, stack-based buffer overflow, and improper authorization vulnerabilities in Advantech WebAccess. Versions 8.4.1 and prior are affected. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, access files and perform actions at a privileged level, or delete files on the system. Advantech has released Version 8.4.2 of WebAccessNode to address the reported vulnerabilities. CISA also recommends a series of measures to mitigate the vulnerabilities.

MITRE has released the 2019 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Errors list. It is a compilation of the most frequent and critical errors that can lead to serious vulnerabilities in software. MITRE notes these weaknesses are often easy to find and exploit and are dangerous because they frequently allow adversaries to completely take over execution of software, steal data, or prevent the software from working. Access the list at MITRE.

CISA has published an advisory on a NULL pointer reference vulnerability in 3S-Smart Software Solutions GmbH CODESYS Control V3 OPC UA Server. Numerous products and versions of these products are affected. Successful exploitation of this vulnerability could cause a denial-of-service condition. 3S-Smart Software Solutions GmbH has released Version 3.5.15.0 to resolve this vulnerability for all affected CODESYS products. CISA also recommends a series of measures for mitigating the vulnerability.