CISA Urges Administrators To Review Newly Released Six ICS Advisories

The Cybersecurity and Infrastructure Safety Company (CISA) has issued a call to action for administrators and security mavens to search out out about six newly released Industrial Care for watch over Systems (ICS) advisories.

These advisories, released on June 11, 2024, present severe information on latest security issues, vulnerabilities, and exploits affecting ICS.

CISA advisories hide a vary of merchandise from well-known distributors, highlighting the significance of smartly timed updates and vigilance in cybersecurity practices.

Below are the six newly released Industrial Care for watch over Systems (ICS) advisories:

1. Rockwell Automation ControlLogix, GuardLogix, and CompactLogix

Rockwell Automation’s ControlLogix, GuardLogix, and CompactLogix controllers had been is assumed as having a severe vulnerability (CVSS v4 rating: 8.3).

The vulnerability, characterised by an always-erroneous alter waft implementation, has a low attack complexity and can compromise the availability of the affected devices.

Affected Merchandise

Rockwell Automation reports the next controllers are affected:

• ControlLogix 5580: V34.011
• GuardLogix 5580: V34.011
• 1756-EN4: V4.001
• CompactLogix 5380: V34.011
• Compact GuardLogix 5380: V34.011
• CompactLogix 5480: V34.011

CVE-2024-5659– Vulnerability Overview

Repeatedly-Mistaken Care for watch over Float Implementation (CWE-670) – This vulnerability, CVE-2024-5659, will even be exploited by sending new packets to the mDNS port, ensuing in a well-known nonrecoverable fault in all affected controllers on the an identical network.

The CVSS v3.1 substandard rating is 7.4, and the CVSS v4 substandard rating is 8.3.

2. AVEVA PI Web API

AVEVA’s PI Web API has been is assumed as having a severe vulnerability (CVSS v4 rating: 8.4).

This vulnerability, which is exploitable remotely with low attack complexity, involves the deserialization of untrusted information and can enable an attacker to operate code remotely.

Affected Merchandise

The following variations of AVEVA PI Web API, a RESTful interface to the PI system, are affected:

• AVEVA PI Web API: Versions 2023 and prior

CVE-2024-3468– Vulnerability Overview

Deserialization of Untrusted Data (CWE-502) – This vulnerability, is assumed as CVE-2024-3468, permits malicious code execution on the PI Web API atmosphere below the privileges of an interactive user who has been socially engineered to use the API XML import functionality with attacker-equipped jabber material.

The CVSS v3.1 substandard rating is 7.6, and the CVSS v4 substandard rating is 8.4.

3. AVEVA PI Asset Framework Shopper

A severe vulnerability (CVSS v4 rating: 7.0) has been known in AVEVA’s PI Asset Framework Shopper.

This vulnerability, which has a low attack complexity, involves the deserialization of untrusted information and can enable malicious code execution.

Affected Merchandise

The following variations of AVEVA PI Asset Framework Shopper, a tool to mannequin both physical or logical objects, are affected:

• PI Asset Framework Shopper: 2023
• PI Asset Framework Shopper: 2018 SP3 P04 and prior

CVE-2024-3467– Vulnerability Overview

Deserialization of Untrusted Data (CWE-502) – This vulnerability, is assumed as CVE-2024-3467, permits malicious code execution on the PI Scheme Explorer atmosphere below the privileges of an interactive user who has been socially engineered to import attacker-equipped XML.

The CVSS v3.1 substandard rating is 7.3, and the CVSS v4 substandard rating is 7.0.

4. Intrado 911 Emergency Gateway

A severe vulnerability (CVSS v4 rating: 10.0) has been known in Intrado’s 911 Emergency Gateway (EGW).

This vulnerability, exploitable remotely with low attack complexity, involves SQL injection and can enable an attacker to operate malicious code, exfiltrate information, or manipulate the database.

Affected Merchandise

The following variations of Intra plot’s 911 Emergency Gateway are affected:

• 911 Emergency Gateway (EGW): All variations

CVE-2024-1839– Vulnerability Overview

Depraved Neutralization of Particular Parts Archaic in an SQL Expose (‘SQL Injection’) (CWE-89) – This vulnerability, is assumed as CVE-2024-1839, impacts the login originate of Intrado’s 911 Emergency Gateway.

It is miles at risk of an unauthenticated blind time-basically based SQL injection, which would possibly per chance furthermore just enable an attacker to operate malicious code, exfiltrate information, or manipulate the database.

The CVSS v3.1 and v4 substandard rankings are each 10.0.

5. Schneider Electrical APC Easy UPS On-line Monitoring Scheme (Change A)

A severe vulnerability (CVSS v3 rating: 9.8) has been known in Schneider Electrical’s APC Easy UPS On-line Monitoring Scheme.

This vulnerability, exploitable remotely with low attack complexity, involves OS whine injection and missing authentication for severe functions. Public exploits are in the market.

Affected Merchandise

The following variations of Easy UPS On-line Monitoring Scheme for Windows 10, 11, Windows Server 2016, 2019, 2022 are affected:

• APC Easy UPS On-line Monitoring Scheme: v2.5-GA-01-22261 and prior
• Schneider Electrical Easy UPS On-line Monitoring Scheme: Version V2.5-GA-01-22320 and prior

Vulnerability Overview

Lacking Authentication for Serious Feature (CWE-306)

A vulnerability exists that would furthermore enable adjustments to administrative credentials, ensuing in possible a long way off code execution without requiring prior authentication on the Java RMI interface.

• CVE-2023-29411: CVSS v3 substandard rating of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Depraved Neutralization of Particular Parts frail in an OS Expose (‘OS Expose Injection’) (CWE-78)

Prior variations of Schneider Electrical APC Easy UPS On-line have an OS Expose Injection vulnerability that would furthermore trigger a long way off code execution when manipulating interior systems thru the Java RMI interface.

• CVE-2023-29412: CVSS v3 substandard rating of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Lacking Authentication for Serious Feature (CWE-306)

A vulnerability exists that would furthermore trigger a denial-of-provider condition when accessed by an unauthenticated user on the Schneider UPS Video display provider.

• CVE-2023-29413: CVSS v3 substandard rating of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

6. MicroDicom DICOM Viewer

A severe vulnerability (CVSS v4 rating: 8.7) has been known in MicroDicom’s DICOM Viewer.

This vulnerability, exploitable remotely with low attack complexity, involves immoral authorization in the handler for a custom URL scheme and a stack-basically based buffer overflow.

Affected Merchandise

The following variations of MicroDicom DICOM Viewer, a clinical image viewer, are affected:

• DICOM Viewer: Versions earlier than 2024.2

Vulnerability Overview

Depraved Authorization in Handler for Customized URL Scheme (CWE-939) – An attacker would possibly per chance furthermore retrieve sensitive recordsdata (clinical photography), plant fresh clinical photography, or overwrite existing clinical photography on a sufferer’s system.

User interaction is required to use this vulnerability.

• CVE-2024-33606: CVSS v3.1 substandard rating of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
• CVSS v4 rating: 8.6 (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

Stack-Essentially basically based Buffer Overflow (CWE-121) – The affected product is at risk of a stack-basically based buffer overflow, that would enable an attacker to operate arbitrary code on affected DICOM Viewer installations. User interaction is required to use this vulnerability.

• CVE-2024-28877: CVSS v3.1 substandard rating of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
• CVSS v4 rating: 8.7 (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CISA’s Name to Action

CISA urges all administrators and security mavens to search out out about these advisories and rob appropriate actions to mitigate the known dangers.

This entails applying patches, updating instrument, and implementing suggested security features.

The company emphasizes staying urged referring to the most fresh security threats and declaring tough cybersecurity practices to present protection to severe infrastructure.