Cybersecurity

ICS-CERT has released an advisory on an ABB FOX515T vulnerability. FOX515T release 1.0 is affected. Successful exploitation of this vulnerability could allow for a local attacker to craft a malicious script that would enable retrieval of any file on the server. ABB reports that the product has been phased out and has reached obsolete status. No further maintenance is planned for the product. ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

ICS-CERT has released an advisory on a Korenix JetNet vulnerability. Numerous versions of JetNet, an Ethernet switch, are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to gain remote access to the device to run arbitrary code and perform man-in-the-middle attacks. Korenix has produced new firmware that removes the undocumented hard-coded credentials from supported systems. ICS-CERT.

ICS-CERT has released an advisory on a Progea Movicon SCADA/HMI vulnerability. Movicon Version 11.5.1181 and prior are affected. Successful exploitation of these vulnerabilities could allow privilege escalation or arbitrary code execution. Progea has not provided an update to address these vulnerabilities, however, it has issued a knowledge base article about DLL Hijacking. NCCIC/ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

ICS-CERT has released an advisory on a WECON Technology Co., Ltd. LeviStudio HMI Editor vulnerability. LEVI Studio HMI Editor v1.8.1 and prior are affected. Successful exploitation of these vulnerabilities may result in denial of service and arbitrary code execution. WECON recommends that users update to v1.8.2. ICS-CERT.