Cybersecurity

ICS-CERT has released an advisory on a Schneider Electric Pelco VideoXpert Enterprise vulnerability. All versions prior to 2.1 are affected. Successful exploitation of these vulnerabilities may allow an authorized user to gain system privileges or an unauthorized user to view files. Schneider Electric has released firmware Version 2.1 for VideoXpert to address these vulnerabilities. ICS-CERT also recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

ICS-CERT has released an alert on a Siemens LOGO! Soft Comfort vulnerability. All versions of LOGO! Soft Comfort prior to V8.2 are affected. Successful exploitation of this vulnerability could allow a remote attacker in a privileged network position to manipulate a software package during download. Siemens removed the Update Center from LOGO! Soft Comfort V8.2 and provides SHA-256 checksums for all LOGO! Soft Comfort software packages via a secured HTTPS channel.

ICS-CERT has released an alert on an ABB Ellipse vulnerability. The vulnerability affects Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). Successful exploitation of this vulnerability could allow an attacker to discover authentication credentials by sniffing the network traffic. ABB has released several product updates to mitigate the vulnerability. ICS-CERT also recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

ICS-CERT has released an alert on an Ecava IntegraXor vulnerability. Versions of Ecava IntegraXor v.6.1.1030.1 and prior are affected. Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information from the database or generate an error in the database log. Ecava recommends that users of affected IntegraXor versions update to version 6.1.1215.0 or newer. ICS-CERT also recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.