ics-cert

The NCCIC has released an advisory on a vulnerability in Rockwell Automation Arena. Versions 15.10.00 and prior are affected. Successful exploitation of this vulnerability could cause the software application to crash. Rockwell Automation encourages affected users to upgrade to the latest version of Arena software, 15.10.01 (or later). The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities. NCCIC/ICS-CERT.

The NCCIC has released an advisory about vulnerabilities in Lantech IDS 2102. Versions 2.0 and prior are affected. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on the system through crafting malicious input. The NCCIC reports Lantech has been unresponsive to its outreach; in the meantime, the NCCIC recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities. NCCIC/ICS-CERT.

The NCCIC has released an advisory on vulnerabilities in Delta Electronics PMSoft. All versions prior to 2.10 are affected. Successful exploitation of these vulnerabilities could cause the application to crash; stack-based buffer overflow conditions may allow arbitrary code execution. Delta Electronics recommends affected users update to at least PMSoft v2.11, which was made available as of March 22, 2018, or the latest available version. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of the vulnerabilities.

The NCCIC has released an advisory on vulnerabilities in Advantech WebAccess HMI Designer. Versions 2.1.7.32 and earlier are affected. Successful exploitation of these vulnerabilities may allow an attacker to remotely execute arbitrary code. The NCCIC is working with Advantech to provide mitigation steps to resolve the issues. In the meantime, the NCCIC recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities. NCCIC/ICS-CERT.