Cybersecurity

SAP has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. This includes an OS command injection vulnerability (CVE-2020-6364) affecting SAP Solution Manager and SAP Focused Run. CISA encourages users and administrators to review the SAP Security Notes for October 2020 and apply the necessary updates.

CISA has published an advisory on a use of client-side authentication vulnerability in Siemens SIPORT MP. Versions 3.2.1 and prior are affected. Successful exploitation of this vulnerability could allow an authenticated attacker to impersonate other users of the system and perform (potentially administrative) actions on behalf of those users if the single sign-on feature (“Allow logon without password”) is enabled. Siemens has released an updated version of SIPORT MP and recommends users install this update on all affected systems.

CISA has published an advisory on a stack-based buffer overflow vulnerability in Fieldcomm Group HART-IP and hipserver. For HART-IP Developer kit, release 1.0.0.0 is affected. For hipserver, release 3.6.1 is affected. Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. Fieldcomm Group recommends users restrict access to the computers or devices running the software. Users of hipserver should immediately upgrade source code to v3.7.0 or later.

CISA has published an advisory on an out-of-bounds read vulnerability in LCDS LAquis SCADA. Versions prior to 4.3.1.870 are affected. Successful exploitation of this vulnerability could allow an attacker to execute code under the privileges of the application. LCDS recommends users update to Version 4.3.1.870 or later. CISA also advised on a series of measures to mitigate the vulnerability. Read the advisory at CISA.