Cybersecurity

The NCCIC has released an advisory on a vulnerability in Siemens SIMATIC WinCC OA UI Mobile App. For both Android and Apple users, all versions prior to V3.15.10 are affected. This vulnerability could be exploited by an attacker who tricks an app user to connect to a malicious WinCC OA server. Successful exploitation of this vulnerability could allow an attacker to read and write data from and to the app’s project cache folder. Siemens has provided updates to mitigate this vulnerability.

The NCCIC has released an advisory on vulnerabilities in OSIsoft PI Vision API. PI Web API versions 2017 R2 and prior are affected. Successful exploitation of these vulnerabilities could allow escalated privileges and may allow remote code execution. OSIsoft recommends that users upgrade to PI Vision 2017 R2 Update 1 or PI AF Services 2017 R2 Update 1, which both address the PI Web API vulnerabilities. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

The NCCIC has released an advisory on vulnerabilities in OSIsoft PI Data Archive. OSIsoft PI Data Archive versions 2016 R2 and prior are affected. Successful exploitation of these vulnerabilities could cause loss of network access to the device or allow escalated privileges that may result in gaining full control of the PI Data Archive server. OSIsoft recommends that customers upgrade to PI Data Archive 2017 R2. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.