The Cybersecurity and Infrastructure Security Agency (CISA) reports it is aware of an email phishing scam that tricks users into clicking on malicious attachments that look like legitimate Department of Homeland Security (DHS) notifications (CISA is part of DHS). The email campaign uses a spoofed email address to appear like a National Cyber Awareness System (NCAS) alert and lure targeted recipients into downloading malware through a malicious attachment.
The threat group Dragos tracks as XENOTIME has expanded its target set to include US electric utilities. XENOTIME is the group responsible for the TRISIS/TRITON malware, and the only group known to target safety instrumented systems (SIS). In February 2019, Dragos identified a persistent pattern of activity attempting to gather information and enumerate network resources associated with US and Asia-Pacific electric utilities.
As the air-gap becomes a thing of the past (many say it is already gone), how should industrial organizations, including utilities and other critical infrastructure facilities, maintain control and security of OT environments? While there are several fundamental cybersecurity controls that protect our networks, one program must be tackled before all others can be duly implemented – asset inventory. If it seems cybersecurity advice keeps harping on the need to perform an accurate, comprehensive, and current asset inventory, there is good reason – you cannot protect what you do not know.
Exim has released patches to address a vulnerability affecting Exim versions 4.87–4.91. A remote attacker could exploit this vulnerability to take control of an affected email server. This vulnerability was detected in exploits in the wild. The NCCIC encourages users and administrators to review the Exim CVE-2019-10149 page and either upgrade to Exim 4.92 or apply the necessary patches.
The Federal Trade Commission (FTC) has released an alert on keeping software up to date to help protect sensitive information such as financial and tax information. The NCCIC encourages consumers to review the FTC article and FTC’s OnGuardOnline for additional information.
The NCCIC has published an advisory on use of hard-coded credentials, use of hard-coded cryptographic key, and using components with known vulnerabilities in WAGO Industrial Managed Switches 852-303, 852-1305, and 852-1505. Multiple products and multiple versions of these products are affected. Successful exploitation of these vulnerabilities could allow a compromise of the managed switch, resulting in disruption of communication, and root access to the operating system. WAGO recommends users update their managed switch to the latest firmware.
The NCCIC has published an advisory on an improper authorization vulnerability in Johnson Controls exacqVision Enterprise System Manager. Versions 5.12.2 and prior are affected. Successful exploitation of this vulnerability could allow malicious code execution. Johnson Controls recommends upgrading to the latest product, version 19.03. The NCCIC also advises of a series of mitigating measures for these vulnerabilities. Read the advisory at NCCIC/ICS-CERT.
The NCCIC has published an advisory on improper restriction of operations within the bounds of a memory buffer and session fixation vulnerabilities in Siemens LOGO!8 devices. Multiple versions of these devices are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to escalate privileges and view data transmitted between the device and the user. For some devices, Siemens recommends upgrading to a new version. For others, Siemens has identified specific workarounds and mitigations to reduce the risk.
The NCCIC has published an advisory on improper privilege management and cleartext transmission of sensitive information vulnerabilities in Siemens SIMATIC Ident MV420 and MV440 Families. All versions of both products are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to escalate privileges and view data transmitted between the device and the user. Siemens has identified specific workarounds and mitigations to reduce the risk. The NCCIC also advised on a series of mitigating measures for the vulnerabilities.
The NCCIC has published an advisory on improper authorization, incorrect user management, and missing authorization vulnerabilities in Siemens Siveillance VMS. Multiple products and versions of the products are affected. Successful exploitation of these vulnerabilities could allow an attacker with network access to Port 80/TCP to change device properties, user roles, and user-defined event properties. Siemens has released updates to address the vulnerabilities. The NCCIC also advised on a series of mitigating measures for the vulnerabilities.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
