InfoSecBulletin Cybersecurity for mankind
CISA released three ICS advisories on January 4, 2024. These advisories give important information about security issues, vulnerabilities, and exploits concerning ICS.
ICSA-24-004-01 Rockwell Automation FactoryTalk Activation: Vulnarability overview
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
Rockwell Automation FactoryTalk Activation Manager and Studio 5000 Logix Designer uses the affected Wibu-Systems’ products which internally use a version of libcurl that is vulnerable to a buffer overflow attack if curl is configured to redirect traffic through a SOCKS5 proxy. A malicious proxy can exploit a bug in the implemented handshake to cause a buffer overflow. If no SOCKS5 proxy has been configured, there is no attack surface.
CVE-2023-38545 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AFFECTED PRODUCTS:
The following versions of Factory Talk are affected: Factory Talk: V4.00 (Utilizes Wibu-Systems CodeMeter <7.60c)
ICSA-24-004-02 Mitsubishi Electric Factory Automation Products: Vulnarability overview
The affected products contain an observable timing discrepancy vulnerability in their RSA decryption implementation. By sending specially crafted packets and performing a Bleichenbacher style attack, an attack method to decrypt ciphertext by observing the behavior when a padding error occurs, an attacker could decrypt the ciphertext and disclose sensitive information.
CVE-2022-4304 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
AFFECTED PRODUCTS:
The following Factory Automation products are affected:
GT SoftGOT2000: Versions 1.275M to 1.290C (CVE-2023-0286)
OPC UA Data Collector: Versions 1.04E and prior (CVE-2023-0286)
MX OPC Server UA (Software packaged with MC Works64): Versions 3.05F and later (Packaged with MC Works64 Version 4.03D and later) (CVE-2022-4304)
OPC UA Server Unit: All versions (CVE-2022-4304)
FX5-OPC: Versions 1.006 and prior (CVE-2022-4304, CVE-2022-4450)
ICSA-23-348-15 Unitronics Vision and Samba Series (Update A): Vulnarability overview
Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated attacker with network access to a PLC or HMI can take administrative control of the system.
CVE-2023-6448 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AFFECTED PRODUCTS:
The following Unitronics products are affected:
VisiLogic: Versions prior to 9.9.00
OS: Versions prior to 12.38
CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
