Actors, Threats and Vulnerabilities 24 to 30 April 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, they identified a total of eight attacks that were executed. These attacks were taking advantage of three different...

Siemens SIMATIC CP Cleartext Storage of Sensitive Information (CVE-2021-33716)

A vulnerability has been identified in SIMATIC CP 1543-1 incl. SIPLUS variants All versions V3.0, SIMATIC CP 1545-1 All versions V1.1. An attacker with access to the subnet of the affected device could retrieve sensitive information stored in cleartext. This plugin only works with Tenable.ot...

Siemens Industrial Products Intel CPUs Missing Encryption of Sensitive Data (CVE-2020-12357)

Improper initialization in the firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900...

Siemens SIMATIC CP 44x-1 RNA Uncontrolled Resource Consumption (CVE-2022-27640)

A vulnerability has been identified in SIMATIC CP 442-1 RNA All versions V1.5.18, SIMATIC CP 443-1 RNA All versions V1.5.18. The affected devices improperly handles excessive ARP broadcast requests. This could allow an attacker to create a denial of service condition by performing ARP storming...

Siemens SCALANCE XCM332 Use After Free (CVE-2022-1652)

Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the badflpintr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service...

Siemens SCALANCE XCM332 Allocation of Resources Without Limits or Throttling (CVE-2021-46828)

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svcrun infinite loop without accepting new connections. This plugin only works with Tenable.ot. Please visit...

Siemens SCALANCE XCM332 Improper Validation of Syntactic Correctness of Input (CVE-2022-35252)

When curl is used to retrieve and parse cookies from a HTTPS server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing asister site to deny service to all siblings. This plugin only works with...

Siemens TIM 4R-IE Devices Concurrent Execution Using Shared Resource with Improper Synchronization (CVE-2016-4954)

The processpacket function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service peer- variable modification by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication...

CISA Urges Organizations to Incorporate the FCC Covered List Into Risk Management Plans

The Federal Communications Commission FCC maintains a Covered List of communications equipment and services that have been determined by the U.S. government to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons to national...

CISA Warns of Critical Flaws in Illumina's DNA Sequencing Instruments

The U.S. Cybersecurity and Infrastructure Security Agency CISA has released an Industrial Control Systems ICS medical advisory warning of a critical flaw impacting Illumina medical devices. The issues impact the Universal Copy Service UCS software in the Illumina MiSeqDx, NextSeq 550Dx, iScan, iS...

Illumina Universal Copy Service

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Illumina Equipment: Universal Copy Service UCS Vulnerabilities: Binding to an Unrestricted IP Address, Execution with Unnecessary Privileges 2. RISK EVALUATION Successful exploitation of these...

Scada-LTS Third Party Component

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Scada-LTS Equipment: Scada-LTS Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow loss of sensitive...

CVE-2023-29007

creationtimestamp| type| source ---|---|--- 2023-04-26 00:25:22+00:00| seen| https://t.me/cibsecurity/62860 2023-04-26 14:35:07+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4251 2023-04-27 07:06:35+00:00| published-proof-of-concept| https://t.me/arvinclub1/98 2023-04-27...

CVE-2023-25652

creationtimestamp| type| source ---|---|--- 2023-04-26 00:25:15+00:00| seen| https://t.me/cibsecurity/62854 2025-04-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08...

CVE-2023-29469

creationtimestamp| type| source ---|---|--- 2023-04-25 00:19:39+00:00| seen| https://t.me/cibsecurity/62773 2025-02-13 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09...

CVE-2023-28484

creationtimestamp| type| source ---|---|--- 2023-04-25 00:19:34+00:00| seen| https://t.me/cibsecurity/62769 2024-02-10 00:31:41+00:00| seen| https://t.me/ctinow/182363 2025-02-13 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09...

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added three security flaws to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The three vulnerabilities are as follows - CVE-2023-28432 CVSS score - 7.5 - MinIO Information Disclosu...

N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX

The supply chain attack targeting 3CX was the result of a prior supply chain compromise associated with a different company, demonstrating a new level of sophistication with North Korean threat actors. Google-owned Mandiant, which is tracking the attack event under the moniker UNC4736, said the...

CVE-2023-2194

creationtimestamp| type| source ---|---|--- 2023-04-21 00:30:58+00:00| seen| https://t.me/cibsecurity/62555 2025-02-13 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09...

INEA ME RTU

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: INEA Equipment: ME RTU Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED...