You are here

Home » Cybersecurity

Cybersecurity

Mitsubishi Electric MELSEC-Q Series and MELSEC-L Series CPU Modules (ICSA-19-311-01)

CISA has published an advisory on an uncontrolled resource consumption vulnerability in Mitsubishi Electric MELSEC-Q Series and MELSEC-L Series CPU Modules. Numerous versions of these products are affected. Successful exploitation of this vulnerability may prevent the FTP client from connecting to the FTP server on MELSEC-Q Series and MELSEC-L Series CPU module. Only FTP server function is affected by this vulnerability. Mitsubishi Electric has produced a new version of the firmware. It also strongly recommends that users operate the affected device behind a firewall.

U.S. Cyber Command Shares Seven New Malware Samples

U.S. Cyber Command has released seven malware samples to the malware aggregation tool and repository, VirusTotal. The Cybersecurity and Infrastructure Security Agency (CISA) and WaterISAC encourage users and administrators to review U.S. Cyber Command’s VirusTotal page to view the samples as well as the CISA Tip on Protecting Against Malicious Code for best practices on protecting systems and networks against malware.

Omron CX-Supervisor (ICSA-19-309-01) – Product Used in the Energy Sector

CISA has published an advisory on a use of obsolete function vulnerability in Omron CX-Supervisor. Versions 3.5 (12) and prior are affected. Successful exploitation of this vulnerability could result in information disclosure, total compromise of the system, and system unavailability. Omron recommends users update to CX-Supervisor 3.51 (9). CISA also recommends a series of measures to mitigate the vulnerability. Read the advisory at CISA.

DHS Releases Updated Tool for Assessing Cybersecurity

The U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) has just released version 9.2 of its Cyber Security Evaluation Tool (CSET). CSET is a desktop software tool intended to guide asset owners and operators through a consistent process for evaluating control system networks as part of a comprehensive cybersecurity assessment that uses recognized government and industry standards and recommendations.

Honeywell equIP and Performance Series IP Cameras (ICSA-19-304-03) – Products Used in the Energy Sector

CISA has published an advisory on a missing authentication for critical function vulnerability in Honeywell equIP and Performance Series IP Cameras. Honeywell reports the vulnerability affects the equIP series IP camera products listed fully Honeywell security notification 2019-09-13 01. Successful exploitation of this vulnerability could result in unauthenticated access. Honeywell has released firmware update packages for all affected products. CISA also recommends a series of measures to mitigate the vulnerability.

Honeywell equIP Series IP Cameras (ICSA-19-304-02) – Products Used in the Energy Sector

CISA has published an advisory on an improper input validation vulnerability in Honeywell equIP series IP cameras. Honeywell reports the vulnerability affects the equIP series IP camera products listed fully Honeywell security notification 2019-09-13 01. Successful exploitation of this vulnerability could result in denial-of-service conditions. Honeywell has released firmware update packages for all affected products listed above. CISA also recommends a series of measures to mitigate the vulnerability.

Advantech WISE-PaaS/RMM (ICSA-19-304-01) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on path traversal, missing authorization, improper restriction of XML external entity reference, and SQL injection vulnerabilities in Advantech WISE-PaaS/RMM. Versions 3.3.29 and prior are affected. Successful exploitation of these vulnerabilities may allow information disclosure, remote code execution, and compromise system availability. Advantech phased out WISE-PaaS/RMM in July of 2019 and replaced this product with EdgeSense and DeviceOn. CISA also recommends a series of measures to mitigate the vulnerability.

Building a Digital Defense Using Virtual Private Networks

The FBI’s Portland, Oregon office has published an advisory discussing the use of virtual private networks, or VPNs. For those who use public WiFi networks for business or personal computing, VPNs are an incredibly important tool as they render traffic that could otherwise be intercepted by a third party – potentially a malicious actor – as unreadable. Given that there are many different types of VPNs on the market, the FBI offers a series of tips to assist in decisions about which one to choose.

Pages

Subscribe to Cybersecurity