Cybersecurity

The NCCIC has released an advisory on command injection, information exposure, and stack-based buffer overflow vulnerabilities in PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series. All FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32 are affected. Successful exploitation of these vulnerabilities could allow for remote code execution and information disclosure. PHOENIX CONTACT recommends that affected users upgrade to firmware Version 1.34 or higher.

The NCCIC has released an advisory on vulnerabilities in Advantech WebAccess. Multiple versions of this product are affected. Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information from the host and/or target, execute arbitrary code, or delete files. Advantech has released Version 8.3.1 of WebAccess to address the reported vulnerabilities. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

The NCCIC has released an advisory on vulnerabilities in MatrikonOPC Explorer. Versions 5.0 and prior are affected.  If the attacker has local access to the system, an attacker could exploit this vulnerability. This could allow an attacker to transfer unauthorized files from the host system, which could result in unauthorized information disclosure. Matrikon has made fixes to this vulnerability in the version 5.1.0.0 update. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

The NCCIC has released an advisory about a vulnerability in Siemens Siveillance VMS Video Mobile App. For both Siveillance VMS for Android and iOS, all versions prior to V12.1a (2018 R1) are affected. Successful exploitation of this vulnerability may allow an attacker in a privileged network position to read data from and write data to the encrypted communication channel between the app and a server.