You are here

Home » Cybersecurity

Cybersecurity

Moxa EDS-G516E and EDS-510E Series Ethernet Switches (ICSA-20-056-04) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on stack-based buffer overflow, use of a broken or risky cryptographic algorithm, use of hard-coded cryptographic key, use of hard-coded credentials, classic buffer overflow, cleartext transmission of sensitive information, and weak password requirements in Moxa EDS-G516E and EDS-510E Series Ethernet Switches. For both series, versions 5.2 and lower are affected. Successful exploitation of these vulnerabilities could crash the device, execute arbitrary code, and allow access to sensitive information.

Moxa PT-7528 Series and PT-7828 Series Ethernet Switches (ICSA-20-056-03) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on stack-based buffer overflow, use of a broken or risky cryptographic algorithm, use of hard-coded cryptographic key, use of hard-coded credentials, weak password requirements, and information exposure vulnerabilities in Moxa PT-7528 Series and PT-7828 Series Ethernet Switches. For Moxa PT-7528 Series, versions 4.0 and lower are affected. For Moxa PT-7828 Series, versions 3.9 and lower are affected. Successful exploitation of these vulnerabilities could crash the device or allow access to sensitive information.

Moxa ioLogik 2542-HSPA Series Controllers and IOs, and IOxpress Configuration Utility (ICSA-20-056-02) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on cleartext storage of sensitive information, cleartext transmission of sensitive information, and incorrectly specified destination in a communication channel vulnerabilities in Moxa ioLogik 2542-HSPA Series Controllers and IOs and IOxpress Configuration Utility. For Moxa ioLogik 2542-HSPA Series Controllers, versions 3.0 and lower are affected. IOxpress Configuration Utility, versions 2.3.0 and lower are affected. Successful exploitation of these vulnerabilities could crash the device or allow access to sensitive information.

Moxa MB3xxx Series Protocol Gateways (ICSA-20-056-01) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on stack-based buffer overflow, integer overflow to buffer overflow, cross-site request forgery, use of a broken or risky cryptographic algorithm, information exposure, cleartext transmission of sensitive information, weak password requirements, cleartext storage of sensitive information, and incorrectly specified destination in a communication channel vulnerabilities in Moxa MB3170 series, MB3180 series, MB3270 series, MB3280 series, MB3480 series, and MB3660 series. Multiple versions of these products are affected.

ICS Year in Review – Vulnerabilities, Threat Landscape and Activity Groups, and Lessons Learned

ICS cybersecurity company Drago has just published a series of three year-in-review reports, what are intended to be a collection of its first-hand experiences hunting, analyzing, and combatting industrial adversaries that provide asset owners and the practitioner community with actionable defensive recommendations to reduce the overall risks associated with operating critical infrastructure.

Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App) (ICSA-20-051-04)

CISA has published an advisory on cleartext transmission of sensitive information, origin validation error, use of hard-coded credentials, weak password recovery mechanism for forgotten password, and weak password requirements vulnerabilities in Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App). Versions 3.7 and prior of these products are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to gain root access to the underlying operating system of the device and may allow read/write access.

Honeywell NOTI-FIRE-NET Web Server (NWS-3) (ICSA-20-051-03)

CISA has published an advisory on authentication bypass by capture-replay and path traversal vulnerabilities in Honeywell NOTI-FIRE-NET Web Server. Versions 3.50 and earlier are affected. Successful exploitation of these vulnerabilities could result in an attacker bypassing web server authentication methods. Honeywell has released a firmware update package for all affected products and also recommends steps for users to protect themselves. CISA also recommends a series of measures to mitigate the vulnerability.

B&R Industrial Automation Automation Studio and Automation Runtime (ICSA-20-051-01) – Products Used in the Energy Sector

CISA has published an advisory on an improper authorization vulnerability in B&R Industrial Automation Automation Studio and Automation Runtime. Multiple versions of both products are affected. Successful exploitation of this vulnerability may allow a remote attacker to modify the configuration of affected devices. B&R reports product-technical reasons disallow the changing of SNMP credentials. To reduce risk from this vulnerability, the following Automation Studio versions disable the SNMP service by default in newly created AS projects.

Rockwell Automation FactoryTalk Diagnostics (ICSA-20-051-02) – Product Used in the Water and Wastewater Sector

CISA has published an advisory on a deserialization of untrusted data vulnerability in Rockwell Automation Factory Talk Diagnostics. All versions are affected. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to execute arbitrary code with SYSTEM level privileges. Rockwell Automation is currently working to develop updated software that addresses the reported vulnerability. Rockwell Automation recommends affected users implement the compensating controls, based on their needs.

Combination of Banking Trojans and Ransomware Bound to Worsen

IBM’s Security Intelligence has published an article discussing the evolution of banking Trojans, which began a little over a decade ago with the Zeus commercial banking Trojan and have become increasingly sophisticated both in terms of their code and the organized gangs who wield them. While threat actors once primarily used banking Trojans to steal money from corporate accounts, today they are increasingly using them to conduct targeted ransomware attacks that can entail exorbitant payment demands.

Pages

Subscribe to Cybersecurity