Cybersecurity

ICS-CERT has released an alert on a Siemens LOGO! Soft Comfort vulnerability. All versions of LOGO! Soft Comfort prior to V8.2 are affected. Successful exploitation of this vulnerability could allow a remote attacker in a privileged network position to manipulate a software package during download. Siemens removed the Update Center from LOGO! Soft Comfort V8.2 and provides SHA-256 checksums for all LOGO! Soft Comfort software packages via a secured HTTPS channel.

ICS-CERT has released an alert on an ABB Ellipse vulnerability. The vulnerability affects Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). Successful exploitation of this vulnerability could allow an attacker to discover authentication credentials by sniffing the network traffic. ABB has released several product updates to mitigate the vulnerability. ICS-CERT also recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

ICS-CERT has released an alert on an Ecava IntegraXor vulnerability. Versions of Ecava IntegraXor v.6.1.1030.1 and prior are affected. Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information from the database or generate an error in the database log. Ecava recommends that users of affected IntegraXor versions update to version 6.1.1215.0 or newer. ICS-CERT also recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

ICS-CERT has released an alert on a Xionmai Technology IP cameras and DVRs vulnerability. All IP cameras and DVRs using the NetSurveillance Web interface are affected. Successful exploitation of this vulnerability could cause the device to reboot and return to a more vulnerable state in which Telnet is accessible. Xiongmai Technology has not responded to requests to coordinate with NCCIC/ICS-CERT. ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.