ics-cert

The NCCIC/ICS-CERT has released an advisory on vulnerabilities in Rockwelll Automation Stratix Services Router. Allen-Bradley Stratix 5900 Services Router, versions 15.6.3M1 and earlier, are affected. Successful exploitation of these vulnerabilities could result in loss of availability, confidentiality, and/or integrity caused by memory exhaustion, module restart, information corruption, and/or information exposure.

The NCCIC/ICS-CERT has released an advisory on a vulnerability in Yokogawa CENTUM series and Exaopc. Multiple versions of this product are affected. Successful exploitation of this vulnerability could allow a local attacker to generate false system or process alarms, or block system or process alarm displays. Yokogawa has produced mitigations for the affected products. The NCCIC/ICS-CERT also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

The NCCIC/ICS-CERT has released an advisory on vulnerabilities in ATI’s Emergency Mass Notification System. The HPSS16, HPSS32, MHPSS, and ALERT 400 devices are affected. Improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms. ATI has created a patch which adds additional security features to the command packets sent over the radio. Additionally, ATI recommends that, where feasible, simple voice radios be replaced with digital P-25 (APCO) radios, which provide highly secure encrypted links.

The NCCIC/ICS-CERT has released an advisory on vulnerabilities in Moxa MXview. MXview versions 2.8 and prior are affected. Successful exploitation of this vulnerability could allow a remote attacker to access and read cryptographic private keys. Moxa has developed a new version of MXview to mitigate the vulnerability. The NCCIC/ICS-CERT also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities. NCCIC/ICS-CERT.