Critical Auth Bugs Expose Smart Factory Gear to Cyberattack

November 1, 2024 at 01:20PM CISA warns of critical security vulnerabilities in Mitsubishi Electric and Rockwell Automation factory automation software, allowing remote code execution, authentication bypass, and denial-of-service. Two severe bugs (CVE-2023-6943, CVE-2024-10386) have high CVSS scores of 9.8. Manufacturers should apply mitigations promptly due to increased cyber threats from nation-state actors. ### Meeting Takeaways … Read more

Critical Flaws in Tank Gauge Systems Expose Gas Stations to Remote Attacks

September 30, 2024 at 08:30AM Security vulnerabilities in six different Automatic Tank Gauge (ATG) systems have been disclosed, exposing them to remote attacks. Thousands of ATGs are exposed on the internet, making them a target for malicious actors. Additional flaws were found in OpenPLC, Riello NetMan 204, and AJCloud. CISA has highlighted threats to OT … Read more

Apple’s latest macOS release is breaking security software, network connections

September 22, 2024 at 08:59PM macOS Sequoia (macOS 15) has experienced security software issues on updated Apple systems, causing network connectivity problems and software incompatibility. Microsoft and ESET have posted bulletins addressing networking issues. Apple released the update despite being aware of the reported problems. In other news, Craig Newmark has pledged $100M for cyber … Read more

Check your IP cameras: There’s a new Mirai botnet on the rise

August 31, 2024 at 02:28PM An outdated series of IP cameras has been exploited to create a new Mirai botnet. Akamai reported the active campaign leveraging the remote code execution (RCE) vulnerability in AVTECH AVM1203 IP cameras, which have been discontinued since 2019. The botnet also exploits other old vulnerabilities, emphasizing the importance of maintaining … Read more

Cisco warns of critical RCE zero-days in end of life IP phones

August 8, 2024 at 05:34PM Cisco has issued a warning about critical remote code execution vulnerabilities in the web-based management interface of Small Business SPA 300 and SPA 500 series IP phones. These flaws, including buffer overflow vulnerabilities, can allow unauthenticated attackers to execute arbitrary commands. Users are urged to transition to newer, supported models … Read more

VMware fixes critical vCenter RCE vulnerability, patch now

June 18, 2024 at 02:11PM VMware has issued a security advisory for critical vulnerabilities in vCenter Server, impacting versions 7.0 and 8.0, and Cloud Foundation versions 4.x and 5.x. The vulnerabilities include remote code execution and local privilege escalation flaws. The vendor has released fixes for the vulnerabilities and advises applying updates promptly to mitigate … Read more

EPA Issues Alert After Finding Critical Vulnerabilities in Drinking Water Systems

May 21, 2024 at 07:21AM The US EPA issued an enforcement alert on safeguarding drinking water systems from cyber threats. Over 70% of water systems inspected do not comply with the Safe Drinking Water Act and have critical cyber vulnerabilities. Recommendations include reducing internet exposure, regular assessments, changing default passwords, and addressing vulnerabilities. The government … Read more

Germany points finger at Fancy Bear for widespread 2023 hacks, DDoS attacks

May 5, 2024 at 10:39PM German officials have attributed a spate of cyberattacks on government agencies and private industry to APT28, a Russian threat actor linked to the GRU intelligence service. The attacks were reportedly in response to Germany’s decision to send tanks to Ukraine. The US has joined Germany in condemning the attacks and … Read more

Patch up – 4 critical bugs in ArubaOS lead to remote code execution

May 2, 2024 at 04:38PM ArubaOS has disclosed ten vulnerabilities, including four critical buffer overflow issues affecting components such as utility daemon, L2/L3 management service, and automatic reporting service. Exploits can lead to remote code execution. Other medium-severity vulnerabilities were reported, with one researcher credited. Temporary workarounds are recommended, with a suggestion to enable PAPI … Read more