Siemens SIMATIC WinCC and SIMATIC PCS 7 ActiveX Vulnerability

OVERVIEW Mingzheng Li from Acorn Network Security Lab has identified an ActiveX vulnerability in Siemens’ SIMATIC WinCC and SIMATIC PCS 7. Siemens has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Siemens reports that the...

Adcon Telemetry A850 Telemetry Gateway Base Station Vulnerabilities

OVERVIEW Independent researcher Aditya K. Sood has identified a cross-site scripting vulnerability in Adcon Telemetry’s A850 Telemetry Gateway Base Station. Adcon Telemetry has produced a new firmware version to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED...

Moxa MiiNePort Session Hijack Vulnerabilities

OVERVIEW Independent researcher Aditya Sood has identified vulnerabilities in Moxa’s MiiNePort. Moxa has produced new firmware editions to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS Moxa reports that the vulnerabilities affect the followin...

Emerson DeltaV Wireless I/O Card Open SSH Port Vulnerability

OVERVIEW Emerson has identified an open SSH port vulnerability in the DeltaV Wireless I/O Card. Emerson has produced a firmware patch that disables the SSH port. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Emerson reports that the vulnerability affects the following products...

Emerson Liebert SiteScan XML External Entity Vulnerability

OVERVIEW Researcher Evgeny Ermakov from Kaspersky Lab has identified an XML External Entity XXE vulnerability affecting Emerson’s Liebert SiteScan application. Emerson has produced patches to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The...

Westermo WeOS < 4.19.0 Hard-coded Certificate Vulnerability

Westermo WeOS uses the same SSL private key across different customers installations. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Vanderbilt Industries Siemens IP CCTV Cameras Vulnerability

OVERVIEW Siemens reports that there is a vulnerability in Siemens-branded IP cameras from Vanderbilt Industries. Vanderbilt has released updates to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Siemens reports that the vulnerability affects the...

Undocumented SNMP String Exposes Rockwell PLCs to Remote Attacks

An undocumented SNMP community string has been discovered in programmable logic controllers PLCs built by Allen-Bradley Rockwell Automation that exposes these devices deployed in a number of critical industries to remote attacks. Researchers at Cisco Talos today said the vulnerability is in the...

Schneider Electric Magelis HMI Resource Consumption Vulnerabilities (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-308-02A Schneider Electric Magelis HMI Resource Consumption Vulnerabilities that was published November 22, 2016, on the NCCIC/ICS-CERT web site. ICS-CERT is aware of a public report of resource consumption...

Schneider Electric ConneXium Buffer Overflow Vulnerability

OVERVIEW Security researcher George Lashenko of CyberX has identified a buffer overflow vulnerability in Schneider Electric’s ConneXium firewall product. Schneider Electric is developing a firmware update to mitigate this vulnerability. This vulnerability is remotely exploitable. AFFECTED PRODUCT...

Honeywell Experion PKS Improper Input Validation Vulnerability

OVERVIEW Honeywell reported a denial-of-service condition caused by an improper input validation vulnerability in Honeywell’s Experion Process Knowledge System PKS platform. Honeywell has produced patches to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED...

Moxa EDR-810 Industrial Secure Router Privilege Escalation Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified a privilege escalation vulnerability in Moxa’s EDR-810 Industrial Secure Router. Moxa has produced firmware to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following EDR-810 versions ar...

Schneider Electric PowerLogic PM8ECC Hard-coded Password Vulnerability

OVERVIEW Independent researcher He Congwen has identified a hard-coded password vulnerability in Schneider Electric’s PowerLogic PM8ECC device. Schneider Electric has produced a patch to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following...

91 Percent of Public-Facing ICS Components Are Remotely Exploitable

We live in an increasingly connected world, but even in an age when DDoS attacks can take entire airlines offline, many critically sensitive industrial control systems ICS are still connected to the internet. A pair of reports released today by Kaspersky Lab reveal how dire the situation really i...

INDAS Web SCADA Path Traversal Vulnerability

OVERVIEW Independent researcher Ehab Hussein of IOActive has identified a path traversal vulnerability in the INDAS Web SCADA application. INDAS has produced new software to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following INDAS Web SCAD...

The Siemens power monitoring system there are two information disclosure security vulnerability-vulnerability warning-the black bar safety net

Positive Technologies security experts to review Siemens SICAM PASpower automation systemafter the solution is found, Siemens SICAM PAS, the presence of two information disclosure VulnerabilityCVE-2 0 1 6-5 ! Security experts to the West door company to report a safety issue, Siemens immediately...

Siemens Patches Password Reconstruction Vulnerability in SICAM PAS

The Industrial Control Systems Cyber Emergency Response Team ICS-CERT cautioned users who work in electrical substations to update certain builds of energy automation software this week. ICS-CERT claims two vulnerabilities exist in the Siemens SICAM Power Automation System, or PAS, that could...

Siemens SCALANCE M-800/S615 Web Vulnerability

OVERVIEW Siemens has identified a web security vulnerability in Siemen’s SCALANCE M-800 and S615 modules. This vulnerability was reported directly to Siemens by Alexander Van Maele and Tijl Deneut from HOWEST. Siemens has produced a new firmware version to mitigate this vulnerability. AFFECTED...

Moxa Active OPC Server Unquoted Service Path Escalation Vulnerability

OVERVIEW Independent researcher Zhou Yu has identified an unquoted service path escalation vulnerability in Moxa’s Active OPC Server application. Moxa has produced a new version to mitigate this vulnerability. Zhou Yu has tested the new version to validate that it resolves the vulnerability...

Advantech Patches WebAccess Remote Code Execution Flaws

Advantech has published a new version of its WebAccess product to address vulnerabilities that put installations at risk to remote code execution attacks. Exploiting the vulnerabilities would be a challenge, however, according to an advisory published Tuesday by the Industrial Control Systems Cyb...