Cybersecurity

ICS-CERT has released an advisory on a Rockwell Automation FactoryTalk Alarms and Events vulnerability. Several versions of the product are affected. Successful exploitation of this vulnerability may allow an attacker to cause a denial of service condition in the history archiver service running on FactoryTalk Alarms and Events. Rockwell Automation recommends upgrading to the latest version of FactoryTalk Alarms and Events, Version 2.90 or later, and applying available patches. ICS-CERT.

ICS-CERT has released an advisory on a Geovap Reliance vulnerability. Reliance SCADA Version 4.7.3 Update 2 and prior versions are affected. Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject arbitrary JavaScript in a specially crafted URL request that may allow for read/write access. To address this vulnerability, Geovap has released Version 4.7.3 Update 3 of the software. Additionally, ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of the vulnerability.

ICS-CERT has released an advisory on a Siemens SCALANCE W1750D, M800, and S615 vulnerability. All versions of these products are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to crash the DNS service or execute arbitrary code by crafting malicious DNS responses. Siemens reports it is preparing updates for the affected products and recommends a series of mitigations. Additionally, ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of the vulnerability.

ICS-CERT has released an advisory on a Siemens SICAM vulnerability. All versions of SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, DNPi00 are affected. Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code. Siemens provides a series of steps to mitigate this vulnerability, which includes disabling the web server after commissioning. Additionally, ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of the vulnerability.