Cybersecurity

CISA has published an advisory on improper restriction of operations within the bounds of a memory buffer, session fixation, NULL pointer dereference, improper access control, argument injection, and resource management errors vulnerabilities in Mitsubishi Electric GOT2000 Series. GT27, GT25, and GT23 are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition or remote code execution. Mitsubishi recommends users follow as series of steps to update CoreOS to the latest version.

The U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) has released Securing Industrial Control Systems: A Unified Initiative, a multi-year strategy for enhancing ICS security in the U.S., and a companion fact sheet. The initiative features four pillars:

Periodically, critical vulnerabilities are overhyped and require a more practical approach to assessing true impacts. But in this case, Joe Slowik Principal Adversary Hunter at ICS cybersecurity firm Dragos agrees recent statements are quite appropriate for the recent F5 BIG-IP ADC vulnerability CVE-2020-5902.

CISA has published an advisory on path traversal, command injection, unrestricted upload of file with dangerous type, cross-site request forgery, and improper authentication vulnerabilities in Nortek Linear eMerge 50P/5000P. Versions 4.6.07 (revision 79330) and prior are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to gain full system access. Nortek has released v32-09a to address the vulnerabilities. CISA also recommends a series of measures to mitigate the vulnerabilities.