The U.S. Department of Homeland Security National Cybersecurity and Communications Integration Center (NCCIC) has produced a new Security Tip, Proper Disposal of Electronic Devices. The NCCIC emphasizes that in addition to effectively securing sensitive information on electronic devices, it is important to follow best practices for electronic device disposal.
Based on research using open source intelligence resources, cybersecurity firm Trend Micro explores vulnerabilities for two of the most critical infrastructure lifelines. The report, Exposed and Vulnerable Critical Infrastructure: Water and Energy Industries (posted below), demonstrates the ease of discovering and exploiting cyber assets in the water and energy sectors. Primarily using Shodan and other basic open source intelligence (OSINT) techniques, Trend Micro discovered exposed and vulnerable HMIs.
FireEye Intelligence has publicly disclosed information highly suggesting activity linked to TRITON is associated with a Russian government-owned technical research institution. In their recent report, FireEye explains several factors contributing to their assessment that the Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM; a.k.a. ЦНИИХМ) is associated with the development of the secondary malware strains (activity now dubbed TEMP.Veles by FireEye) that aided in the deployment of the primary TRITON payload last November against a Saudi Arabian Petrochemical plant.
Over the past week, two supply-chain attacks have come to light. The first involves VestaCP, a control-panel interface that system administrators use to manage servers. According to security firm Eset, unknown attackers compromised VestaCP servers and used their access to make a malicious change to an installer that was available for download. “The VestaCP installation script was altered to report back generated admin credentials to vestacp.com after a successful installation,” said ESET Malware Researcher Marc-Étienne M.Léveillé.
The American Water Works Association's (AWWA's) Cybersecurity Risk & Responsibility in the Water Sector report seeks to help water utilities understand their cybersecurity risks and what they can do to address them. In addition to discussing the significant risks cyber poses to water utilities, which involves a review of some of the most notable cyber incidents involving the sector, the report also addresses less discussed but nonetheless important aspects of cybersecurity.
libssh has released security updates addressing a vulnerability affecting libssh versions 0.6 and above. A remote attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review the libssh Security Release for additional information and apply the necessary updates.
Microsoft has released a security update to address a vulnerability in the Yammer desktop application. A remote attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review the Microsoft Security Advisory and apply the necessary update. NCCIC/US-CERT.
The NCCIC has released an advisory about authentication bypass by capture-replay, improper access control, and improper authentication vulnerabilities in GAIN Electronic Co. Ltd SAGA1-L Series. All firmware versions prior to A0.10 are affected. Successful exploitation of these vulnerabilities could allow remote code execution and potentially delete the product’s firmware. GAIN Electronic Co. Ltd has recommended that users update to firmware version A0.10. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.
The NCCIC has released an advisory on an authentication bypass by capture-replay vulnerability in Telecrane F25 series. All versions prior to 00.0A are affected. Successful exploitation of this vulnerability could allow unauthorized users to view commands, replay commands, control the device, or stop the device from running. Telecrane recommends upgrading to the latest firmware. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.
The NCCIC has released an advisory on stack-based buffer overflow, external control of file name or path, improper privilege management, and path traversal vulnerabilities in Advantech WebAccess. Versions 8.3.1 and prior are affected. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, access files and perform actions at a privileged level, or delete files on the system. Advantech has released Version 8.3.3 of WebAccess to address the reported vulnerabilities.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
