ICSA-21-231-01_AVEVA SuiteLink Server

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: AVEVA Software, LLC Equipment: SuiteLink Server Vulnerabilities: Heap-based Buffer Overflow, Null Pointer Dereference, Improper Handling of Exceptional Conditions 2. RISK EVALUATION Successful...

Meet critical infrastructure security compliance requirements with Microsoft 365

Critical infrastructure operators face a hostile cyber threat environment and a complex compliance landscape. Every operator of an industrial control system also operates an IT network to service its productivity needs. A supervisory control and data acquisition SCADA system operator of a power...

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from operations that go beyond the buffer boundaries in memory, allowing attackers to execute arbitrary code.

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System IGSS, arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

IoT security: how Microsoft protects Azure Datacenters

Azure Sphere first entered the IoT Security market in 2018 with a clear mission—to empower every organization on the planet to connect and create secure and trustworthy IoT devices. Security is the foundation for durable innovation and business resilience. Every industry investing in IoT must...

The US Military Buys Commercial Location Data

Vice has a long article about how the US military buys commercial location data worldwide. The U.S. military is buying the granular movement data of people around the world, harvested from innocuous-seeming apps, Motherboard has learned. The most popular app among a group Motherboard analyzed...

Forcecontrol Technology Forcecontrol has information leakage vulnerability

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. An information disclosure vulnerability exists in Forcecontrol, which can be exploited by attackers to obtain sensitive information...

Code Injection Vulnerability in ForceControl Technology ForceControl

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. A code injection vulnerability exists in ForceControl, which can be exploited by an attacker to gain control of the server...

Buffer Overflow Vulnerability in ForceControl ForceControl httpsvr.exe

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. A buffer overflow vulnerability exists in ForceControl httpsvr.exe, which can be exploited by an attacker to cause a remote denial of service attack...

Denial of Service Vulnerability in ForceControl Technologies ForceControl

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. A denial of service vulnerability exists in ForceControl, which can be exploited by attackers to cause the software to crash and restart...

Vulnerability of software packages for supervisory control and data collection: MC Works64/MC Works32, FrameWorX server, centralized configuration environment for HMI-/SCADA applications, Platform Services software platform, GenBroker64/GenBroker32 application for organization of access rights exchange. This vulnerability is related to insufficient control over code generation, allowing attackers to execute arbitrary commands.

The vulnerabilities of the software packages for supervisory control and data collection, MC Works64/MC Works32, the FrameWorX server, the centralized configuration environment for HMI-/SCADA applications, the Platform Services software platform, and the GenBroker64/GenBroker32 application for...

Vulnerability of software packages for supervisory control and data collection: MC Works64/MC Works32, FrameWorX server, centralized configuration environment for HMI-/SCADA applications: Workbench, software platform: Platform Services, application for organization of API exchange: GenBroker64/GenBroker32. This vulnerability is related to deficiencies in the deserialization mechanism, allowing a intruder to trigger a service failure.

The vulnerabilities of the software packages for supervisory control and data collection MC Works64/MC Works32, the FrameWorX server, the centralized configuration environment for HMI-/SCADA applications, the Platform Services software platform, and the GenBroker64/GenBroker32 application for...

Inductive Automation Ignition Access Control Error Vulnerability

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA data acquisition and monitoring systems, HMI human machine interface and more. An access control error vulnerability exists in Inductive Automati...

Emerson Electric OpenEnterprise Encryption Issues Vulnerabilities

Emerson Electric OpenEnterprise is a data acquisition and monitoring system SCADA from Emerson Electric, primarily for remote oil and gas applications. A vulnerability exists in Emerson Electric OpenEnterprise 3.3.4 and prior versions due to an encryption issue. An attacker could exploit the...

ABB MicroSCADA Pro SYS600 Access Control Error Vulnerability

ABB MicroSCADA Pro SYS600 is a suite of monitoring and data acquisition software from ABB Switzerland. The software is used for substation automation, SCADA electrical, distribution management applications and industrial power management. An access control error vulnerability exists in ABB...

LCDS LAquis SCADA Information Disclosure Vulnerability (CNVD-2020-25541)

LCDS LAquis SCADA is a SCADA Data Acquisition and Supervisory Control system from the Brazilian company LCDS. The system is mainly used for data acquisition and process control of equipment with communication technology. An information disclosure vulnerability exists in LCDS LAquis SCADA version...

LCDS LAquis SCADA Input Validation Error Vulnerability

LCDS LAquis SCADA is a SCADA Data Acquisition and Supervisory Control system from the Brazilian company LCDS. The system is mainly used for data acquisition and process control of equipment with communication technology. An input validation error vulnerability exists in LCDS LAquis SCADA version...

The vulnerability of the SCADA system MasterSCADA, related to the operation of buffers in memory outside the system’s boundaries, allows a intruder to trigger an emergency termination of the program process.

The vulnerability of the SCADA system MasterSCADA relates to the execution of operations outside the buffer in memory, as well as the use of memory after it has been freed. Exploiting this vulnerability can allow an intruder to cause the program to terminate abnormally...

Triangle MicroWorks SCADA Data Gateway Type Obfuscation Vulnerability

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product from Triangle MicroWorks, Inc. A type confusion vulnerability exists in Triangle MicroWorks SCADA Data Gateway, which can be exploited by an attacker to execute arbitrary code...

Multiple Siemens Products Input Validation Error Vulnerability (CNVD-2020-23038)

Siemens SIMATIC PCS 7 and SIMATIC WinCC are both products of Siemens, Germany.SIMATIC PCS 7 is a process control system.SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. An input validation error vulnerability exists in multiple Siemens products and can be exploited by a...

Analysing the Attack Surface of an Industrial Data Acquisition Device

Introduction The Data Station Plus from Red Lion Controls was handed to me to analyse the attack surface. The device is designed to connect to SCADA data acquisition devices over Modbus, Profibus, etc. by Serial or Ethernet connection. Data is collected and recorded to a local compact flash card...