Cybersecurity

The NCCIC has published an advisory on improper input validation and cryptographic issues vulnerabilities in Siemens SIMATIC RF6XXR. All versions prior to 3.2.1 of RF615R and RF68XR are affected Successful exploitation of these vulnerabilities could allow access to sensitive information. Siemens recommends users upgrade to Version 3.2.1 or newer for both affected products and restrict network access to the device. The NCCIC also advises of a series of measures for mitigating the vulnerabilities.

The NCCIC has published an advisory on heap-based buffer overflow and out-of-bounds read vulnerabilities in Delta Electronics CNCSoft ScreenEditor. Versions 1.00.89 and prior are affected. Successful exploitation of these vulnerabilities could cause buffer overflow conditions that may allow information disclosure, remote code execution, or crash the application. Delta Electronics recommends users update to the latest version, Version 1.00.95, and restrict the interaction of the application to trusted files. The NCCIC also advises of a series of measures for mitigating the vulnerabilities.

Microsoft has released its monthly update to address vulnerabilities in its software. For this month, Microsoft has released security updates for Microsoft Windows, Internet Explorer, Microsoft Edge, Microsoft Office and Microsoft Office Services and Web Apps, Azure DevOps, Open Source Software, .NET Framework, Azure, SQL Server, ASP.NET, Visual Studio, and Microsoft Exchange Server. Read the update at Microsoft.

The NCCIC has published an advisory on user after free vulnerability in Schneider Electric Zelio Soft 2. Zelio Soft 2 versions 5.2 and prior are affected. Successful exploitation of this vulnerability could allow remote code execution through the opening of a specially crafted project file. Schneider Electric reports that version 5.3 of the affected software mitigates the reported vulnerability. The NCCIC also advises of a series of measures for mitigating this vulnerability.