Cybersecurity

CISA has published an advisory on stack-based buffer overflow, integer overflow to buffer overflow, cross-site request forgery, use of a broken or risky cryptographic algorithm, information exposure, cleartext transmission of sensitive information, weak password requirements, cleartext storage of sensitive information, and incorrectly specified destination in a communication channel vulnerabilities in Moxa MB3170 series, MB3180 series, MB3270 series, MB3280 series, MB3480 series, and MB3660 series. Multiple versions of these products are affected.

CISA has published an advisory on cleartext transmission of sensitive information, origin validation error, use of hard-coded credentials, weak password recovery mechanism for forgotten password, and weak password requirements vulnerabilities in Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App). Versions 3.7 and prior of these products are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to gain root access to the underlying operating system of the device and may allow read/write access.

CISA has published an advisory on an improper authorization vulnerability in B&R Industrial Automation Automation Studio and Automation Runtime. Multiple versions of both products are affected. Successful exploitation of this vulnerability may allow a remote attacker to modify the configuration of affected devices. B&R reports product-technical reasons disallow the changing of SNMP credentials. To reduce risk from this vulnerability, the following Automation Studio versions disable the SNMP service by default in newly created AS projects.

IBM’s Security Intelligence has published an article discussing the evolution of banking Trojans, which began a little over a decade ago with the Zeus commercial banking Trojan and have become increasingly sophisticated both in terms of their code and the organized gangs who wield them. While threat actors once primarily used banking Trojans to steal money from corporate accounts, today they are increasingly using them to conduct targeted ransomware attacks that can entail exorbitant payment demands.