Triangle MicroWorks Improper Input Validation

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in multiple Triangle MicroWorks’ products and third‑party components. Triangle MicroWorks has produced an update that mitigates this vulnerability. Adam Crain has...

Schneider Electric Trio J-Series Radio Encryption

OVERVIEW Schneider Electric has self-reported a hard-coded encryption key vulnerability in Schneider Electric’s J-Series Radios. Schneider Electric has produced a patch that mitigates this vulnerability and has published a customer security notification.Schneider Electric Cybersecurity...

Top Server OPC Improper Input Validation Vulnerability

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in the Software Toolbox TOP Server DNP Master OPC product. Software Toolbox has produced a new version that mitigates this vulnerability. The researchers have test...

Siemens COMOS Privilege Escalation Vulnerability

OVERVIEW Siemens has notified ICS-CERT of a privilege escalation vulnerability in the Siemens COMOS database application. Siemens has produced a patch that mitigates this vulnerability. AFFECTED PRODUCTS The following Siemens COMOS versions are affected: All COMOS versions prior to 9.1 COMOS 9.1:...

Sixnet Universal Protocol Undocumented Function Codes (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-13-231-01A Sixnet Universal Protocol Undocumented Function Codes that was published August 26, 2013, on the ICS-CERT Web page. --------- Begin Update B Part 1 of 1 -------- Researchers Kyle Stone and Mehdi Sabraoui...

Kepware Technologies Improper Input Validation Vulnerability

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified a improper input validation vulnerability in the Kepware Technologies’ DNP Master Driver for the KEPServerEX Communications Platform. Kepware Technologies has produced a new version that mitigates this...

Advantech WebAccess Cross-Site Scripting

OVERVIEW This advisory is a follow-up to the alert titled ICS-ALERT-13-009-01 Advantech WebAccess Cross-Site Scripting that was published January 9, 2013, on the ICS-CERT Web page. This advisory provides mitigation details for a vulnerability in Advantech’s WebAccess application. Independent...

OSIsoft Multiple Vulnerabilities

OVERVIEW OSIsoft has identified multiple vulnerabilities in the PI Interface for IEEE C37.118 and reported them to ICS-CERT. OSIsoft has produced a software update that mitigates these vulnerabilities. OSIsoft has tested the software update to validate that it resolves the vulnerabilities...

Schweitzer Engineering Laboratories Improper Input Validation

Overview Adam Crain of Automatak and independent researcher Chris Sistrunk have identified improper DNP3 input validation in Schweitzer Engineering Laboratories’ real-time automation controllers RTAC. Schweitzer Engineering Laboratories SEL has produced updated firmware that mitigates this...

Vendor Admin Accounts Warning

Overview An asset owner recently notified the ICS-CERT that a vendor support contractor had added an administrative-level account during installation of new control systems software. The support contractor intended the account to be the default used to train their people for all future work on...

MOXA Weak Entropy in DSA Keys Vulnerability

Overview Researcher Nadia Heninger of the University of California, San Diego, and researchers Zakir Durumeric, Eric Wustrow, and J. Alex Halderman of the University of Michigan identified an insufficient entropy vulnerability in MOXA OnCell Gateways. MOA produced and released a firmware upgrade ...

Schneider Electric Vijeo Citect, CitectSCADA, PowerLogic SCADA Vulnerability

Overview Schneider Electric has identified an XML external entity vulnerability in Vijeo Citect, CitectSCADA, and PowerLogic SCADA applications. Timur Yunusov, Alexey Osipov, and Ilya Karpov of Positive Technologies reported the vulnerability directly to Schneider Electric. Schneider Electric has...

IOServer Master Station Improper Input Validation

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in the IOServer DNP3 Driver on the master station. IOServer has produced a new version that mitigates this vulnerability. The researchers have tested the new versi...

MatrikonOPC SCADA DNP3 Master Station Improper Input Validation

OVERVIEW This updated advisory was originally posted to the US-CERT secure Portal library on August 02, 2013, and is now being released to the ICS-CERT Web page. Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in...

Siemens Scalance W-7xx Product Family Multiple Vulnerabilities

OVERVIEW Siemens has identified multiple vulnerabilities in the Siemens Scalance W-7xx product family and reported them to ICS-CERT. A software update has been produced by Siemens that mitigates these vulnerabilities. Siemens has tested the software update to validate that it resolves the...

Siemens WinCC TIA Portal Vulnerabilities

OVERVIEW Researchers Timur Yunusov and Sergey Bobrov of Positive Technologies have identified several vulnerabilities in the Siemens WinCC TIA Portal. A software update has been produced by Siemens that mitigates these vulnerabilities. Siemens has tested the software update to validate that it...

Invensys Wonderware HMI Reports XSS and Write Access Violation Vulnerabilities

Overview Independent security researchers Billy Rios and Terry McCorkle have identified cross-site scripting XSS and write access violation vulnerabilities in the Invensys Wonderware HMI reports product. ICS-CERT has coordinated these two vulnerabilities with Invensys, which has produced a new...

Ecava IntegraXor XSS

Overview ICS-CERT received a report from an anonymous security reseacher concerning several cross site scripting XSS vulnerabilities in the Ecava IntegraXor SCADA product. ICS-CERT has worked with the reseacher and Ecava to validate these vulnerabilities. Ecava has developed a patch release of...

Honeywell TEMA Remote Installer ActiveX Vulnerability

Overview Industrial Control Systems Cyber Emergency Response Team ICS-CERT received a report from independent security researchers Billy Rios and Terry McCorkle concerning a vulnerability affecting Honeywell Enterprise Buildings Integrator EBI software systems that have Temaline physical access...

Targeted Phishing Attacks

Summary This advisory is intended to provide general guidance to public and private sector organizations on events potentially triggering targeted phishing attacks often referred to as spear phishing and to offer some suggested methods that may minimize the likelihood of a successful attack. This...

Osama Bin Laden-Themed Phishing

Summary The intent of this advisory is to provide general guidance to public and private sector organizations and individuals on potential targeted phishing attacks often referred to as “spear phishing” with respect to the Osama Bin Laden related media reporting, and to offer some suggested metho...

Inductive Automation Ignition Information Disclosure Vulnerability

Overview ICS-CERT has received a report from Rubén Santamarta concerning a vulnerability in Inductive Automation’s Ignition software. Ignition is an updated version of FactoryPMI Plant Management Interface, offered by Inductive Automation. This vulnerability allows unauthorized users to download...

Triangle Research Nano 10 PLC Denial of Service

OVERVIEW Researcher Jon Christmas of Solera Networks has identified an improper input validation vulnerability in Triangle Research International, Inc.’s Tri Inc. Nano‑10 programmable logic controller PLC. Tri Inc. has produced a firmware upgrade and tested it to validate that the upgrade resolve...

QNX Multiple Vulnerabilities

OVERVIEW Independent researcher Luigi Auriemma identified a stack-based buffer overflow and a buffer copy without checking size of input vulnerabilities in QNX’s Phrelay, Phwindows, and Phditto products without coordination with ICS-CERT, the vendor, or any other coordinating entity known to...

Alstom Grid S1 Agile Improper Authorization

OVERVIEW This advisory provides mitigation details for a vulnerability affecting the Alstom Grid MiCOM S1 Agile and S1 Studio Software. Note: Alstom Grid MiCOM S1 Studio Software is its own software suite. A user could have MiCOM S1 Studio Software from a different vendor. This advisory only...

Monroe Electronics DASDEC Compromised Root SSH Key

OVERVIEW This advisory provides mitigation details for a vulnerability that impacts the Monroe Electronics DASDEC. Mike Davis, a researcher with IOActive, reported a compromised root SSH key vulnerability to CERT Coordination Center CERT/CC. This vulnerability is in Monroe Electronics DASDEC‑I an...

GE Proficy HMI/SCADA CIMPLICITY WebView Improper Input Validation

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 19, 2013, and is now being released to the ICS-CERT-Web page. Independent researchers ZombiE and amisto0x07 have identified an improper input validation vulnerability in the GE CIMPLICITY WebView application...

Siemens Scalance X200 IRT Multiple Vulnerabilities

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact the Siemens Scalance X200 IRT. Siemens has identified multiple vulnerabilities in Siemens Scalance X200 IRT. Siemens has produced an update that mitigates these vulnerabilities. Siemens has tested the update to...

Siemens WinCC 7.2 Multiple Vulnerabilities

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact the Siemens WinCC Web Navigator 7.2. Researchers Alexander Tlyapov, Sergey Gordeychik, and Timur Yunusov of Positive Technologies have identified multiple vulnerabilities in the Siemens WinCC Web Navigator 7.2...

Siemens COMOS Permissions, Privileges, and Access Controls

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact the Siemens COMOS database system. Siemens has identified a permissions, privileges, and access controls vulnerability in the Siemens COMOS database system. Siemens has produced software updates that mitigate this...

IOServer DNP3 Improper Input Validation

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified improper input validation in IOServer’s DNP3 driver software. IOServer has produced an updated software version that mitigates this vulnerability. Adam Crain and Chris Sistrunk updated and tested this versi...

3S CODESYS Gateway Use After Free

OVERVIEW Independent researcher Nicholas Miles has identified a vulnerability in the 3S CODESYS Gateway application that can result in a denial-of-service DoS condition. 3S has produced an update that mitigates this vulnerability. Nicholas Miles has tested this update and validates that it resolv...

Mitsubishi Electric Automation MX Component V3 ActiveX Vulnerability

OVERVIEW This advisory is a follow-up to the alert titled ICS-ALERT-13-091-01 Mitsubishi Electric Automation MX Buffer Overflow Vulnerability that was published April 1, 2013, on the ICS-CERT Web siteICSA-13-091-01, http://ics-cert.us-cert.gov/alerts/ICSA-13-091-01, last accessed May 20, 2013...

Wonderware Intelligence Tableau Server Ruby on Rails Improper Input Validation (Update A)

Overview This updated advisory was orignally posted to the US-CERT secure Portal library on February 5, 2013, and is now being released to the ICS-CERT Web page. Mitigation details for multiple vulnerabilities that impact third-party software integrated into the Invensys Wonderware Intelligence...

TURCK BL20 and BL67 Programmable Gateway Hard-Coded User Accounts

OVERVIEW Researcher Rubén Santamarta of IOActive has identified hard-coded user accounts in TURCK’s BL20 and BL67 Programmable Gateways. Exploitation of this vulnerability would allow an attacker to have remote administrative access to the device. This vulnerability affects programmable gateways...

Galil RIO-47100 Improper Input Validation

Overview This advisory provides mitigation details for a vulnerability affecting the Galil RIO-47100 “Pocket PLC.” Researcher Jon Christmas of Solera Networks has identified an improper validation vulnerability in the Galil RIO-47100 PLC, which can result in a loss of availability. Galil has...

Wonderware Information Server Vulnerabilities

Overview This advisory was originally posted to the US-CERT secure Portal library on April 23, 2013, and is now being released to the ICS-CERT Web page. This advisory provides mitigation details for multiple vulnerabilities that impact the Invensys Wonderware Information Server WIS software...

MatrikonOPC Multiple Product Vulnerabilities

Overview This advisory was originally posted to the US-CERT secure Portal library on April 16, 2013, and is now being released to the ICS-CERT Web page. Independent researcher Dillon Beresford of Cimation has identified vulnerabilities in two MatrikonOPC products; MatrikonOPC A&E Historian and...

Schneider Electric MiCOM S1 Studio Improper Authorization Vulnerability

Overview This advisory provides mitigation details for a vulnerability affecting the Schneider Electric MiCOM S1 Studio Software. Independent researcher Michael Toecker of Digital Bond has identified an improper authorization vulnerability in the MiCOM S1 Studio Software using the Microsoft Attac...

Canary Labs Inc Trend Link Insecure ActiveX Control Method

Overview This advisory provides mitigation details for a vulnerability in the Canary Labs, Inc. Trend Link software. Researcher Kuang-Chun Hung of Security Research and Service Institute−Information and Communication Security Technology Center ICST has identified an insecure ActiveX control metho...

Cogent Real-Time Systems Vulnerabilities

Overview Dillon Beresford of Cimation has identified four vulnerabilities in the Cogent Real-Time Systems DataHub application. Cogent has produced an update that mitigates these vulnerabilities. These vulnerabilities could be exploited remotely. Affected Products Cogent Real-Time Systems reports...

Rockwell Automation FactoryTalk and RSLinx Vulnerabilities

OVERVIEW --------- Begin Update A Part 1 of 4 -------- This updated advisory is a follow-up to the original advisory titled ICSA-13-095-02 Rockwell Automation FactoryTalk and RSLinx Vulnerabilities that was published April 5, 2013, on the ICS-CERT Web page. --------- End Update A Part 1 of 4...

Wind River VxWorks SSH and Web Server and General Electric D20MX

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Wind River, General Electric Equipment: VxWorks, D20MX --------- Begin Update A Part 1 of 4 --------- Vulnerabilities: Improper Input Validation --------- End Update A Part 1 of 4 --------- 2...

Rockwell Automation FactoryTalk RNADiagReceiver

Overview This Updated Advisory is a follow-up to the original Advisory titled “ICSA-12-088-01 – Rockwell Automation FactoryTalk RNADiagReceiver DOS Vulnerabilities” that was published March 28, 2012 on the ICS-CERT web page. This advisory is a follow-up to ICS-CERT Alert...

Ecava IntegraXor ActiveX Directory Traversal

Overview Independent researchers Billy Rios and Terry McCorkle have identified a Path Traversal vulnerability in the Ecava IntegraXor application. Ecava has produced an update that mitigates this vulnerability. The researchers have validated that the patch fixes this vulnerability. Affected...

Wonderware System Platform Buffer Overflows

Overview ICS-CERT originally released Advisory ICSA-12-081-01P on the US-CERT secure portal on March 21, 2012. This web page release was delayed to allow users time to download and install the update. Independent researcher Celil Unuver from SignalSec Corporation has identified two buffer overflo...

Microsoft Remote Desktop Protocol Memory Corruption Vulnerability

Overview ICS-CERT is aware of a public report of a Remote Desktop Protocol RDP vulnerability with proof-of-concept PoC exploit code affecting multiple Microsoft Windows operating systems. RDP is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to...

Siemens Automation License Manager Uncontrolled Resource Consumption

Overview This advisory provides mitigation details for a vulnerability that impacts the Siemens Automation License Manager ALM. Siemens ProductCERT has identified an uncontrolled resource consumption vulnerabilitySSA-783261, https://cert-portal.siemens.com/productcert/pdf/ssa-783261.pdf, Web site...

Wonderware Information Server Multiple Vulnerabilities

Overview ICS-CERT originally released Advisory “ICSA-12-062-01PInvensys Wonderware Information Server Multiple Vulnerabilities” on the US-CERT secure portal on March 02, 2012. This web page release was delayed to allow users time to download and install the update. Independent security researche...

ABB Robot Communications Runtime Buffer Overflow

Overview ICS-CERT received a report from ABB and the Zero Day Initiative ZDI concerning a buffer overflow vulnerability in the Robot Communication Runtime software used to communicate with IRC5, IRC5C, and IRCP robot controllers. This vulnerability was reported to ZDI by independent security...