Cybersecurity

ICS-CERT has released an advisory on a LAVA Computer MFG Inc. Ether-Serial Link vulnerability. Versions 6.01.00/29.03.2007 and prior are affected. Successful exploitation of this vulnerability could allow an attacker to spoof the IP address of an authenticated user, assume the authenticated user’s identity, and gain privileges or access to the system. As LAVA Computer MFG Inc. has not responded to requests to work with ICS-CERT to mitigate this vulnerability, ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

ICS-CERT has released an advisory on a Siemens 7KT PAC1200 Data Manager vulnerability.

ICS-CERT has released an advisory on a Digium Asterisk GUI vulnerability. Asterisk GUI 2.1.0 and prior are affected. Successful exploitation of this vulnerability could cause an authenticated attacker to execute arbitrary code on the device. Asterisk GUI is no longer maintained and should not be used. Digium recommends affected users to migrate to Digium’s SwitchVox product. ICS-CERT.

ICS-CERT has released an advisory on a Ctek, Inc. SkyRouter vulnerability. SkyRouter Series 4200 and 4400 all versions prior to V6.00.11 are affected. Successful exploitation of this vulnerability may allow an unauthorized user to view and edit settings without authenticating. Ctek, Inc., reports it has addressed this issue and addressed additional security requirements in its latest security release V6.00.11, which is now available on all models currently in production. ICS-CERT.