You are here

Home » Cybersecurity

Cybersecurity

Phoenix Contact PLCNext AXC F 2152 (ICSA-19-155-01)

The NCCIC has published an advisory on key management errors, improper access control, using component with known vulnerabilities, and man-in-the-middle vulnerabilities in Phoenix Contact PLCNext AXC F 2152. Article numbers 2404267 and 1046568 are affected. Successful exploitation of these vulnerabilities could allow an attacker to decrypt passwords, bypass authentication, and deny service to the device. In addition, these vulnerabilities could interact with third-party vulnerabilities to cause other impacts to integrity, confidentiality, and availability.

Geutebrück G-Cam and G-Code (ICSA-19-155-03) – Products Used in the Energy Sector

The NCCIC has published an advisory on cross-site scripting and OS command injection vulnerabilities in Geutebrück G-Cam and G-Code. Numerous products and versions of the products are affected. Successful exploitation of these vulnerabilities could allow remote code execution as root and remote code execution in the browser of the IP camera operator. Geutebrück recommends users upgrade to the latest firmware, Version 1.12.13.2 or later. The NCCIC also recommends a series of mitigating measures.

AVEVA Vijeo Citect and CitectSCADA (ICSA-19-150-01) – Products Used in the Energy Sector

The NCCIC has published an advisory on an insufficiently protected credentials vulnerability in AVEVA Vijeo Citect and CitectSCADA. Verions 7.30 and 7.40 of Citect and CitectSCADA are affected. Successful exploitation of this vulnerability could allow a locally authenticated user to obtain Citect user credentials. AVEVA recommends all affected users download and upgrade to CitectSCADA 2018 as soon as possible. The NCCIC also provided a list of recommended measures to mitigate this vulnerability.

Emerson Ovation OCR400 Controller (ICS-19-148-01) – Product Used in the Water and Wastewater and Energy Sectors

The NCCIC has published an advisory on stack-based buffer overflow and heap-based buffer overflow vulnerabilities in Ovation OCR400 Controller. Devices running version 3.3.1 or earlier are affected. Successful exploitation of these vulnerabilities may allow privilege escalation or remote code execution, or it may halt the controller. Emerson is issuing a notice to its customer base with mitigation recommendations, encouraging users with this older software to upgrade to a more current version supported by Emerson and the third-party vendor.

Privacy Awareness Week

The Federal Trade Commission (FTC) has released an announcement promoting Privacy Awareness Week (PAW). PAW is an annual event fostering awareness of privacy issues and the importance of protecting personal information. This year’s theme, “Protecting Privacy is Everyone’s Responsibility,” focuses on promoting privacy awareness for consumers and businesses.

Mitsubishi Electric MELSEC-Q Series Ethernet Module (ICSA-19-141-02)

The NCCIC has published an advisory on an uncontrolled resource consumption vulnerability in Mitsubishi Electric MELSEC-Q Series Ethernet Module. MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior are affected. Successful exploitation of this vulnerability may render the device unresponsive, requiring a physical reset of the PLC. Mitsubishi Electric has released new firmware Version 20122 for the QJ71E71-100 Ethernet module to mitigate the reported vulnerability. The NCCIC has also provided a series of measures to address this vulnerability.

Computrols CBAS Web (ICSA-19-141-01)

The NCCIC has published an advisory on cross-site request forgery, information exposure through discrepancy, cross-site scripting, command injection, information exposure through source code, use of hard-coded cryptographic key, SQL injection, authentication bypass using an alternate path or channel, and inadequate encryption strength vulnerabilities in Computrols CBAS Web. Numerous versions of this product are affected.

Presidential Executive Order Gives Authority to Block Foreign Tech that Poses Risks to National Security

President Trump has signed the executive order “Securing the Information and Comunications Technology and Services Supply Chain,” which gives the federal government the authority to block telecommunications or information technology that are deemed an “unacceptable risk” to national security. The executive order doesn’t specifically mention Huawei, but concerns about the potential security implications of U.S. companies using components from the Chinese tech giant, as well as from other Chinese manufacturers, in their infrastructure undoubtedly contributed to its release.

Pages

Subscribe to Cybersecurity