Cybersecurity

ICS-CERT has released an advisory on an ABB FOX515T vulnerability. FOX515T release 1.0 is affected. Successful exploitation of this vulnerability could allow for a local attacker to craft a malicious script that would enable retrieval of any file on the server. ABB reports that the product has been phased out and has reached obsolete status. No further maintenance is planned for the product. ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of this vulnerability.

The Government Accountability Office has published a review of the physical security and cybersecurity risk assessments the U.S. Department of Homeland Security conducts for critical infrastructure, such as the Infrastructure Survey Tool used by the Protective Security Advisor (PSA) program. The review includes an overview of DHS’s risk assessment practices, discusses private sector representatives’ views of the usefulness of the assessments, and describes how the risk information influences DHS’s strategic planning and private sector outreach.

ICS-CERT has released an advisory on a SpiderControl MicroBrowser vulnerability. MicroBrowser Windows XP; Vista 7, 8, and 10; and versions 1.6.30.144 and prior are affected. Exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system. SpiderControl has provided software update Version 1.6.30.148 for MicroBrowser, which fixes this vulnerability. ICS-CERT.

ICS-CERT has released an advisory on a ProMinent MultiFLEX M10a Controller vulnerability. All versions of MultiFLEX M10a Controller web interface are affected. Successful exploitation of these vulnerabilities could allow an attacker to bypass protection mechanisms, assume the identity of authenticated users, and change the device configuration. ProMinent has not provided mitigations for these vulnerabilities. ICS-CERT recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.