Cybersecurity

The NCCIC has published an advisory on a command injection vulnerability in Siemens Spectrum Power 4.7. Spectrum Power 4 with Web Office Portal is affected. Successful exploitation of this vulnerability in versions of Spectrum Power 4 using the user-specific project enhancement (PE) Web Office Portal (WOP) are affected by an OS command injection vulnerability. The vulnerability could be exploited by an unauthenticated attacker with network access to the affected service. No user interaction is required to exploit this vulnerability.

The Center for Internet Security (CIS), the home of WaterISAC’s partner MS-ISAC, has announced enhancements to its CIS Controls with the release of version 7.1. This latest version introduces Implementation Groups (IGs) to the CIS Controls. The IGs are a simple and accessible way to help organizations classify themselves and focus their security resources and expertise while leveraging the value of the CIS Controls. The CIS Controls are internationally-recognized cybersecurity best practices for defense against common threats; they have been downloaded more than 150,000 times to date.

The NCCIC has published an advisory on resource management errors and improper input validation vulnerabilities in Rockwell Automation Stratix 5400/5410/5700/8000/8300 and ArmorStratix 5700. Numerous products and versions of those products are affected. Successful exploitation of these vulnerabilities could result in a denial-of-service condition or time synchronization issues across the network via reloading the device, a buffer overflow, or memory exhaustion. Rockwell Automation recommends users upgrade to the latest versions and to apply a series of general guidelines.

The NCCIC has published an advisory on a use after free vulnerability in Omron CX-Programmer within CX-One. CX-Programmer v9.70 and prior and Common Components January 2019 and prior are affected. Successful exploitation of this vulnerability could allow an attacker to execute code under the privileges of the application. Omron has released an updated version of CX-One to address the vulnerability. The NCCIC has also provided a series of measures for mitigating the vulnerability.