VPNFilter Update - VPNFilter exploits endpoints, targets new devices

Introduction Cisco Talos, while working with our various intelligence partners, has discovered additional details regarding "VPNFilter." In the days since we first published our findings on the campaign, we have seen that VPNFilter is targeting more makes/models of devices than initially thought,...

VPNFilter Malware Infects 500k Routers Including Linksys, MikroTik, NETGEAR

Malware called VPNFilter has infected 500,000 router brands ranging from Linksys, MikroTik, NETGEAR and TP-Link that are mostly used in home offices. Researchers at Cisco Talos said they decided to warn the public of the threat despite the fact the infected devices and malware are still under...

VPNFilter Destructive Malware

NCCIC is aware of a sophisticated modular malware system known as VPNFilter. Devices known to be affected by VPNFilter include Linksys, MikroTik, NETGEAR, and TP-Link networking equipment, as well as QNAP network-attached storage NAS devices. Devices compromised by VPNFilter may be vulnerable to...

MODBUS/TCP Server Detection (SCADA)

Binary data 700242.prm...

MODBUS/TCP Client Detection (SCADA)

Binary data 700243.prm...

Buffer Overflow Vulnerability in HOLLYWOOD LE5109L PLCs

HELISE Group is a professional automation company integrating R&D, production, sales and technical service. With integrated Ethernet, PROFIBUS-DP, RS232 and RS485 interfaces, HELISE's PLCs have been widely used in electric power, chemical industry, metallurgy, energy and other fields. A buffer...

Denial of Service Vulnerability in the Hologic LE5109L PLC

HELISE Group is a professional automation company integrating R&D, production, sales and technical service. With integrated Ethernet, PROFIBUS-DP, RS232 and RS485 interfaces, HELISE's PLCs have been widely used in electric power, chemical industry, metallurgy, energy and other fields. A denial of...

Denial of Service Vulnerability in Hologic LE5109L PLC (CNVD-2018-08756)

HELISE Group is a professional automation company integrating R&D, production, sales and technical service. With integrated Ethernet, PROFIBUS-DP, RS232 and RS485 interfaces, HELISE's PLCs have been widely used in electric power, chemical industry, metallurgy, energy and other fields. A denial of...

Information Disclosure Vulnerability in Hologic LE5109L PLCs

HELISE Group is a professional automation company integrating R&D, production, sales and technical service. With integrated Ethernet, PROFIBUS-DP, RS232 and RS485 interfaces, HELISE's PLCs have been widely used in electric power, chemical industry, metallurgy, energy and other fields. An...

CVE-2017-14462

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information,...

CVE-2017-14462

CVE-2017-14462 affects Allen-Bradley MicroLogix 1400 Series B FRN 21.2 and earlier. The issue is an improper access-control in data, program, and function file permissions that lets unauthenticated, remote attackers send crafted packets to read/write files, disclose sensitive information, modify ...

CVE-2018-4838

A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module DNP3 variant All versions V1.04, EN100 Ethernet module PROFINET IO variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module IEC 104...

Authorization

A vulnerability has been identified in DIGSI 4 All versions V4.92, EN100 Ethernet module DNP3 variant All versions V1.05.00, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module Modbus TCP variant All versions, EN100...

CVE-2018-4840

A vulnerability has been identified in DIGSI 4 All versions V4.92, EN100 Ethernet module DNP3 variant All versions V1.05.00, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module Modbus TCP variant All versions, EN100...

CVE-2018-4838

CVE-2018-4838 affects Siemens EN100 Ethernet module variants (IEC 61850 < V4.30, DNP3 < V1.04, PROFINET IO, Modbus TCP, IEC 104

CVE-2018-4838

A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module DNP3 variant All versions V1.04, EN100 Ethernet module PROFINET IO variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module IEC 104...

CVE-2018-4840

CVE-2018-4840 affects Siemens DIGSI 4 and EN100 Ethernet modules (DNP3, IEC 104, IEC 61850, Modbus TCP, PROFINET IO). The issue allows an unauthenticated remote attacker to upload a modified device configuration that overwrites the access-authorization passwords. Affected products include DIGSI 4...

CVE-2018-4840

A vulnerability has been identified in DIGSI 4 All versions V4.92, EN100 Ethernet module DNP3 variant All versions V1.05.00, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module Modbus TCP variant All versions, EN100...

ICSA-18-067-02_Siemens SIPROTEC 4, SIPROTEC Compact, and Reyrolle Devices using the EN100 Ethernet Communication Module Extension (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIPROTEC 4, SIPROTEC Compact, and Reyrolle devices using the EN100 Ethernet communication module extension Vulnerability: Missing Authentication for Critical Function 2. UPDATE...

Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Rockwell Automation Equipment: Allen-Bradley MicroLogix 1400 Controllers Vulnerability: Buffer Overflow AFFECTED PRODUCTS The following versions of MicroLogix 1400 Controllers, a PLC, are affected: MicroLogix 1400...