Cybersecurity

The NCCIC has released an advisory on vulnerabilities in WECON Technology Co., Ltd. LeviStudio HMI Editor and PI Studio HMI Project Programmer. WECON LeviStudioU version 1.10, part of WECON LeviStudioU 1.8.29 and prior, and PI Studio HMI Project Programmer Build from November 11, 2017 to prior, are affected. Successful exploitation of these vulnerabilities could allow remote code execution. WECON recommends that users update to the latest version. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of the vulnerabilities.

The NCCIC has released an advisory on vulnerabilities in Intel 2G modem. A series of Intel and Sofia products that use the Intel 2G modem are affected. Successful exploitation of this buffer overflow vulnerability may allow remote code execution. Intel is making firmware updates available to device manufacturers that protect systems from this vulnerability. The NCCIC recommends customers should check with their device manufacturers and apply any available updates as soon as practical.

The NCCIC/ICS-CERT has released an advisory on vulnerabilities in Rockwell Automation Stratix Industrial Managed Ethernet Switch. Allen-Bradley Stratix 8300 Industrial Managed Ethernet Switches, versions 15.2(4a)EA5 and earlier, are affected. Successful exploitation of these vulnerabilities could result in loss of availability, confidentiality, and/or integrity caused by memory exhaustion, module restart, information corruption, and/or information exposure. Rockwell Automation has released knowledge base article 1073315 and recommends implementing a series of mitigations.

The NCCIC/ICS-CERT has released an advisory on vulnerabilities in Rockwelll Automation Stratix Services Router. Allen-Bradley Stratix 5900 Services Router, versions 15.6.3M1 and earlier, are affected. Successful exploitation of these vulnerabilities could result in loss of availability, confidentiality, and/or integrity caused by memory exhaustion, module restart, information corruption, and/or information exposure.