Cybersecurity

ICS-CERT has released an advisory on a Geovap Reliance vulnerability. Reliance SCADA Version 4.7.3 Update 2 and prior versions are affected. Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject arbitrary JavaScript in a specially crafted URL request that may allow for read/write access. To address this vulnerability, Geovap has released Version 4.7.3 Update 3 of the software. Additionally, ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of the vulnerability.

ICS-CERT has released an advisory on a Siemens SCALANCE W1750D, M800, and S615 vulnerability. All versions of these products are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to crash the DNS service or execute arbitrary code by crafting malicious DNS responses. Siemens reports it is preparing updates for the affected products and recommends a series of mitigations. Additionally, ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of the vulnerability.

ICS-CERT has released an advisory on a Siemens SICAM vulnerability. All versions of SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, DNPi00 are affected. Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code. Siemens provides a series of steps to mitigate this vulnerability, which includes disabling the web server after commissioning. Additionally, ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of the vulnerability.

ICS-CERT has released an advisory on a Schneider Electric InduSoft Web Studio and InTouch Machine Edition vulnerability. For InduSoft Web Studio, v8.0 SP2 Patch 1 and prior versions are affected; for InTouch Machine Edition, v8.0 SP2 Patch 1 and prior versions are affected. Successful exploitation of this vulnerability could allow a remote un-authenticated attacker to remotely execute code with high privileges. For both products, Schneider Electric recommends users upgrade to v8.1 as soon as possible.