Cybersecurity

CISA has published an advisory on SQL injection, improper restriction of rendered UI layers or frames, and exposure of sensitive information to an unauthorized actor vulnerabilities in Siemens Desigo Insight. All versions of this product are affected. Successful exploitation of these vulnerabilities could allow an attacker to retrieve or modify data and gain access to sensitive information. Fieldcomm Group recommends users restrict access to the computers or devices running the software. Siemens has identified specific workarounds and mitigations users can apply to reduce risk.

CISA has published an advisory on an untrusted search path vulnerability in Flexera InstallShield. Versions through 2015 SP1 are affected. CISA’s advisory also notes that Flexera InstallShield is integrated into many products sold by other companies. Successful exploitation of this vulnerability could allow execution of a malicious DLL.

CISA has published an advisory on session fixation, improper privilege management, weak password requirements, cleartext transmission of sensitive information, improper restriction of excessive authentication attempts, and exposure of sensitive information to an unauthorized actor vulnerabilities in MOXA NPort IAW5000A-I/O Series. Firmware Version 2.1 or lower is affected.

October 13, 2020

CISA has updated this advisory with additional details on the affected products. Read the advisory at CISA.

September 8, 2020

CISA has updated this advisory with additional details on the affected products and mitigation measures. Read the advisory at CISA.