You are here

Home » Cybersecurity

Cybersecurity

LCDS – Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Laquis SCADA (ICSA-18-289-01) – Product Used in the Water and Wastewater and Energy Sectors

The NCCIC has released an advisory on untrusted pointer dereference, out-of-bounds read, integer overflow to buffer overflow, path traversal, out-of-bounds write, and stack-based buffer overflow vulnerabilities in LCDS – Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Laquis SCADA. Smart Security Manager Versions 4.1.0.3870 and prior are affected. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, crash the system, or write controlled content to the target system. LCDS recommends that users update to Version 4.1.0.4114.

FBI Releases Article on Defending Against Payroll Phishing Scams

The Federal Bureau of Investigation (FBI) has released an article on building a digital defense against phishing scams targeting electronically deposited paychecks. In these schemes, scammers use phishing emails to direct employees to fraudulent websites and collect their work credentials. Scammers then use victims’ credentials to replace legitimate direct deposit information with their own account details.

How Cyber Secure is Your Utility?

An article by WaterISAC Lead Analyst Chuck Egli published in the October 2018 edition of the Water Environment Federation’s Water Environment & Technology magazine discusses the most significant threats to water and wastewater utilities today. Foremost among these are threats that emerge from nation-states like Russia China, Iran, and North Korea, all of which U.S. counterterrorism and law enforcement officials have issued warnings about in recent years and months.

National Cybersecurity Awareness Month: It’s Everyone’s Job to Ensure Online Safety at Work

The theme for this week of National Cybersecurity Awareness Month is “Workplace Security,” and the National Cyber Security Alliance (NCSA) reminds employees in all work environments that online safety and security are a responsibility shared by all. The NCSA recommends a top-down approach to create a culture of cybersecurity in the workplace and refers to a list of steps developed by the National Institute for Standards and Technology (NIST) it says will help businesses tremendously as they formulate plans to keep themselves secure.

Cybersecurity for Water Utilities

An article recently published in WaterWorld discusses the host of cyber risks confronting water and wastewater utilities, noting that managing them will require a culture shift. Risks have arisen from the advent of new technologies that expand attack surfaces and heighten the potential consequences of an attack and vulnerabilities introduced via supply chains. As described by the article, fortunately there is a growing awareness within the sector of these risks as well as a proliferation of tools and other resources to help water and wastewater utilities prevent and mitigate incidents.

Delta Industrial Automation TPEditor (ICSA-18-284-03)

The NCCIC has released an advisory on out-of-bounds write and stack-based buffer overflow vulnerabilities in Delta Industrial Automation TPEditor. Versions 1.90 and prior are affected. Successful exploitation of these vulnerabilities could crash the accessed device, resulting in a buffer overflow condition that may allow remote code execution. Delta Electronics recommends affected users update to the latest version of Delta Industrial Automation TPEditor, Version 1.91. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

NUUO NVRmini2 and NVRsolo (ICSA-18-284-01)

The NCCIC has released an advisory on stack-based buffer overflow and leftover debug code vulnerabilities in NUUO NVRmini2 and NVRsolo. Versions 3.8.0 and prior are affected. Successful exploitation of these vulnerabilities could allow an attacker to achieve remote code execution and user account modification. NUUO has developed a fix for the reported vulnerabilities and recommends users update to firmware v3.9.1. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

Fuji Electric Energy Savings Estimator (ICSA-18-282-07)

The NCCIC has released an advisory on an uncontrolled search path element vulnerability in Fuji Electric Energy Savings Estimator. Versions 1.0.2.0 and prior are affected. Successful exploitation of this vulnerability may allow an attacker to load a malicious DLL and execute code on the affected system with the same privileges as the application that loaded the malicious DLL. Fuji Electric has released Version V.1.0.2.1 of the software. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

Hangzhou Xiongmai Technology Co., Ltd Xmeye P2P Cloud Server (ICSA-18-282-06)

The NCCIC has released an advisory predictable from observable state, hidden functionality, missing encryption of sensitive vulnerabilities in Hangzhou Xiongmai Technology Co., Ltd Xmeye P2P Cloud Server. Successful exploitation of these vulnerabilities could allow unauthorized access to video feeds with the potential to modify settings, replace firmware, and/or execute code. Hangzhou Xiongmai Technology Co., Ltd has not provided mitigations for these vulnerabilities.

Pages

Subscribe to Cybersecurity