Industrial Robots are Hackable: How Do We Fix Them?

Discuss cyber attacks involving robots and many people might think you’re talking about the latest Hollywood blockbuster to hit the screens. The reality, however, is that industrial robotic systems now form a vital cog in the manufacturing process of everything from silicon chips to cars and even...

Ransomware, Cyberespionage Dominate Verizon DBIR

Ransomware dominated malware-related data breaches investigated by Verizon last year, appearing in 71 percent of cases, according to the annual Verizon Data Breach Investigations Report DBIR released Thursday. Compared to last year’s DBIR report, ransomware attacks are up 50 percent. Still, Veriz...

BLF-Tech LLC VisualView HMI

CVSS v3 7.0 ATTENTION: Low skill level to exploit Vendor: BLF-Tech LLC Equipment: VisualView HMI Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following VisualView HMI versions are affected: VisualView HMI Version 9.9.14.0 and prior. IMPACT Successful exploitation of this...

Wecon Technologies LEVI Studio HMI Editor

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Wecon Technologies Equipment: LEVI Studio HMI Editor Vulnerabilities: Heap-Based Buffer Overflow, Stack-Based Buffer Overflow AFFECTED PRODUCTS The following versions of LEVI Studio HMI Editor, a HMI programming...

APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat

APT10 Background APT10 MenuPass Group is a Chinese cyber espionage group that FireEye has tracked since 2009. They have historically targeted construction and engineering, aerospace, and telecom firms, and governments in the United States, Europe, and Japan. We believe that the targeting of these...

Aviation-Related Phishing Campaigns Seeking Credentials

A wave of email-based phishing campaigns is targeting airline consumers with messages that contain malware that infects systems or links to spoofed airline websites that are personalized to trick victims into handing over personal or business credentials. “Over the past several weeks, we have see...

Advantech WebAccess

CVSS v3 7.1 ATTENTION: Low skill level to exploit Vendor: Advantech Equipment: WebAccess Vulnerability: DLL Hijacking AFFECTED PRODUCTS The following WebAccess, an HMI, versions are affected: Advantech WebAccess Versions 8.1 and prior. IMPACT Successful exploitation of this vulnerability could...

ICSA-17-038-01_Sielco Sistemi Winlog SCADA Software

CVSS v3 7.2 Vendor: Sielco Sistemi Equipment: Winlog SCADA Software Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following Sielco Sistemi products are affected: Winlog Lite SCADA Software, versions prior to Version 3.02.01, and Winlog Pro SCADA Software, versions prior to...

Honeywell XL Web II Controller Vulnerabilities

OVERVIEW Independent researcher Maxim Rupp has identified vulnerabilities in Honeywell’s XL Web II controller application. Honeywell has produced a new version to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following XL Web II controlle...

PHOENIX CONTACT mGuard

CVSS V3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: mGuard Vulnerability: Software update changes password to default AFFECTED PRODUCTS PHOENIX CONTACT reports that the vulnerability affects the following mGuard products: Only devices that hav...

ABB Panel Builder 800 DLL Hijacking Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-077-01 ABB Panel Builder 800 DLL Hijacking Vulnerability that was published March 17, 2016, on the NCCIC/ICS-CERT web site. Ivan Sanchez from Nullcode Team has identified a DLL Hijacking vulnerability in the ABB...

SISCO MMS-EASE and AX-S4 ICCP Denial of Service Vulnerabilities

SISCO MMS-EASE and AX-S4 ICCP are both products of SISCO Corporation, USA. The former is a set of C programming interfaces APIs for MMS Manufacturing Message Specification and the latter is a set of data sharing software.SNAP-Lite Utility is one of the data mining and analysis components. A...

ICS-CERT Report Grim Reminder of State of Critical Infrastructure Security

U.S. critical infrastructure got another reminder this week that it needs to do more to protect itself from cyber attacks with the release of an annual government report. The NCCIC/ICS-CERT FY 2015 Annual Vulnerability Coordination Report points out that nagging issues continue to plague industri...

PLC Blaster Worm Targets Industrial Control PLCs

LAS VEGAS – Security researchers at Black Hat USA described a proof-of-concept worm that targets weaknesses within automated industrial control systems used to manage critical infrastructure and manufacturing. The worm, according to OpenSource Security, has the capability to autonomously search f...

SAP Manufacturing Integration Intelligence Cross-Site Scripting Vulnerability

SAP Manufacturing Integration Intelligence also known as MII, formerly known as xMII is a set of Germany's SAP SAP will be the core of the manufacturing system and enterprise process integration platform. A cross-site scripting vulnerability in SAP Manufacturing Integration Intelligence allows...

CVE-2016-4016

Cross-site scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence aka MII, formerly xMII 15 allows remote attackers to inject arbitrary web script or HTML via the title parameter to webdynpro/resources/sap.com/xappsxmiiuiadminnavigation/NavigationApplication, aka SAP Securi...

CVE-2016-4016

Cross-site scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence aka MII, formerly xMII 15 allows remote attackers to inject arbitrary web script or HTML via the title parameter to webdynpro/resources/sap.com/xappsxmiiuiadminnavigation/NavigationApplication, aka SAP Securi...

Cross site scripting

Cross-site scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence aka MII, formerly xMII 15 allows remote attackers to inject arbitrary web script or HTML via the title parameter to webdynpro/resources/sap.com/xappsxmiiuiadminnavigation/NavigationApplication, aka SAP Securi...

CVE-2016-4016

CVE-2016-4016: SAP Manufacturing Integration Intelligence (MII / xMII) 15 is affected by a reflected cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script via the title parameter of the NavigationApplication URL (webdynpro/resources/sap.com/xapps~xmii~ui~admin~navigati...

The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to read arbitrary files.

The vulnerability of the Manufacturing Integration and Intelligence xMII component of the SAP NetWeaver software integration platform is related to deficiencies in name-based path restrictions. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...