Cybersecurity

An attacker with local access to the affected product may be able to read and replace configuration files and log into accounts for which they do not have the correct authorization. A successful exploit of these vulnerabilities is likely to cause a denial of service.  Emerson has created a patch to mitigate these vulnerabilities.

Products affected: DeltaV Versions 10.3.1, 11.3, 11.3.1, and 12.3

Read ICS-CERT Advisory 14-133-02.

Researcher John Leitch, working with HP’s Zero Day Initiative (ZDI), has identified an SQL injection vulnerability in CSWorks’ CSWorks software framework. CSWorks has produced an updated version that mitigates this vulnerability. This vulnerability could be exploited remotely.

AFFECTED PRODUCTS

The following CSWorks software versions are affected:

CSWorks Version 2.5.5050.0 and prior.

Read ICS-CERT Advisory 14-135-01.

On April 09, 2014, Unified Automation GmbH announced that its OPC UA Software Development Kits (SDKs) for Windows included vulnerable OpenSSL libraries. HTTPS support is disabled by default in Unified Automation SDK products. However if HTTPS is used, Unified Automation recommends replacing the OpenSSL library with a current version (1.01.g or later) to mitigate this vulnerability.

This vulnerability could be exploited remotely. Exploits that target this vulnerability are known to be publicly available.

In July 2012, the EPA released a Cyber Security 101 document for water utilities that provides a quick overview of the key features of any active and effective cyber security program. The document addresses potential types of cyber attacks on water systems, how cyber attacks can affect water systems, and basic recommendations for preventing cyber attacks.