Cybersecurity

CISA has published an advisory on improper restriction of operations within the bounds of a memory buffer and SQL injection vulnerabilities in Rockwell Automation EDS Subsystem. Numerous products and version of these products are affected. Successful exploitation of these vulnerabilities could lead to a denial-of-service condition. Rockwell Automation recommends a series of measures to mitigate the vulnerabilities. CISA also recommends a series of measures to mitigate the vulnerabilities.

Yesterday U.S. Department of Justice, FBI, and U.S. Small Business Administration (SBA) officials warned the public about potential fraud schemes related to economic stimulus programs intended to assist small business owners during the COVID-19 pandemic. “During these unprecedented times, when small business owners impacted by COVID-19 are doing their best to keep their businesses afloat, it is easy to fall prey to scammers.

CISA has published an advisory on external control of file name or path, improper verification of cryptographic signature, improper access control, uncontrolled search path element, and improper authorization vulnerabilities in Opto 22 SoftPAC Project. Versions 9.6 and prior are affected. Successful exploitation of these vulnerabilities could allow arbitrary file write access with system access, start or stop service, allow remote code execution, and limit system availability. Opto 22 released PAC Project 10.3 to address the vulnerabilities.

May 12, 2020

CISA has updated this advisory with additional information on the affected products and mitigation measures. Read the advisory at CISA.

December 10, 2019

CISA has updated this advisory with additional details on the affected measures and mitigation measures. Read the advisory at CISA.