Found 123 bookmarks
Custom sorting
ICS Patch Tuesday: Major Vendors Address Code Execution Vulnerabilities
ICS Patch Tuesday: Major Vendors Address Code Execution Vulnerabilities
securityweek.com - August 2025 ICS Patch Tuesday advisories have been published by Siemens, Schneider, Aveva, Honeywell, ABB and Phoenix Contact. August 2025 Patch Tuesday advisories have been published by several major companies offering industrial control system (ICS) and other operational technology (OT) solutions. Siemens has published 22 new advisories. One of them is for CVE-2025-40746, a critical Simatic RTLS Locating Manager issue that can be exploited by an authenticated attacker for code execution with System privileges. The company has also published advisories covering high-severity vulnerabilities in Comos (code execution), Siemens Engineering Platforms (code execution), Simcenter (crash or code execution), Sinumerik controllers (unauthorized remote access), Ruggedcom (authentication bypass with physical access), Simatic (code execution), Siprotect (DoS), and Opcenter Quality (unauthorized access). Siemens also addressed vulnerabilities introduced by the use of third-party components, including OpenSSL, Linux kernel, Wibu Systems, Nginx, Nozomi Networks, and SQLite. Medium- and low-severity issues have been resolved in Simotion Scout, Siprotec 5, Simatic RTLS Locating Manager, Ruggedcom ROX II, and Sicam Q products. As usual, Siemens has released patches for many of these vulnerabilities, but only mitigations or workarounds are available for some of the flaws. Schneider Electric has released five new advisories. One of them describes four high-severity vulnerabilities in EcoStruxure Power Monitoring Expert (PME), Power Operation (EPO), and Power SCADA Operation (PSO) products. Exploitation of the flaws can lead to arbitrary code execution or sensitive data exposure. In the Modicon M340 controller and its communication modules the industrial giant fixed a high-severity DoS vulnerability that can be triggered with specially crafted FTP commands, as well as a high-severity issue that can lead to sensitive information exposure or a DoS condition. In the Schneider Electric Software Update tool, the company patched a high-severity vulnerability that can allow an attacker to escalate privileges, corrupt files, obtain information, or cause a persistent DoS. Medium-severity issues that can lead to privilege escalation, DoS, or sensitive credential exposure have been patched in Saitel and EcoStruxure products. Honeywell has published six advisories focusing on building management products, including several advisories that inform customers about Windows patches for Maxpro and Pro-Watch NVR and VMS products. The company has also released advisories covering PW-series access controller patches and security enhancements. Aveva has published an advisory for two issues in its PI Integrator for Business Analytics. Two vulnerabilities have been patched: one arbitrary file upload issue that could lead to code execution, and a sensitive data exposure weakness. ABB told customers on Tuesday about several vulnerabilities affecting its Aspect, Nexus and Matrix products. Some of the flaws can be exploited without authentication for remote code execution, obtaining credentials, and to manipulate files and various components. Phoenix Contact has informed customers about a privilege escalation vulnerability in Device and Update Management. The company has described it as a misconfiguration that allows a low-privileged local user to execute arbitrary code with admin privileges. Germany’s CERT@VDE has also published a copy of the Phoenix Contact advisory. The US cybersecurity agency CISA has published three new advisories describing vulnerabilities in Santesoft Sante PACS Server, Johnson Controls iSTAR, and Ashlar-Vellum products. CISA has also distributed the Aveva advisory and one of the Schneider Electric advisories. A few days prior to Patch Tuesday, Rockwell Automation published an advisory informing customers about several high-severity code execution vulnerabilities affecting its Arena Simulation product. Also prior to Patch Tuesday, Mitsubishi Electric released an advisory describing an information tampering flaw in Genesis and MC Works64 products.
#securityweek.com#EN#2025#August2025#CISA#ICS#Siemens#Schneider#Aveva#Honeywell#ABB#PhoenixContact#iOT
·securityweek.com·
ICS Patch Tuesday: Major Vendors Address Code Execution Vulnerabilities
Critical Flaws Patched in Rockwell FactoryTalk, Micro800, ControlLogix Products
Critical Flaws Patched in Rockwell FactoryTalk, Micro800, ControlLogix Products
securityweek.com - Rockwell Automation has published several advisories describing critical and high-severity vulnerabilities affecting its products. Rockwell Automation this week published several advisories describing critical- and high-severity vulnerabilities found recently in its products. The industrial automation giant has informed customers about critical vulnerabilities in FactoryTalk, Micro800, and ControlLogix products. In the FactoryTalk Linx Network Browser the vendor fixed CVE-2025-7972, a flaw that allows an attacker to disable FTSP token validation, which can be used to create, update, and delete FTLinx drivers. In the case of Micro800 series PLCs, Rockwell resolved three older vulnerabilities affecting the Azure RTOS open source real-time operating system. The security holes can be exploited for remote code execution and privilege escalation. In addition to the Azure RTOS issues, the company has addressed a DoS vulnerability. In ControlLogix products Rockwell patched a remote code execution vulnerability tracked as CVE-2025-7353. The list of high-severity flaws includes two DoS issues in FLEX 5000, a code execution vulnerability in Studio 5000 Logix Designer, web server issues in ArmorBlock 5000, a privilege escalation in FactoryTalk ViewPoint, and an information exposure issue in FactoryTalk Action Manager. None of these vulnerabilities have been exploited in the wild, according to Rockwell Automation. The cybersecurity agency CISA has also published advisories for these vulnerabilities to inform organizations about the potential risks.
#securityweek.com#EN#2025#RockwellAutomation#FactoryTalk#CISA#iOT#ControlLogix#CVE-2025-7353#FLEX5000
·securityweek.com·
Critical Flaws Patched in Rockwell FactoryTalk, Micro800, ControlLogix Products
Microsoft warns of high-severity flaw in hybrid Exchange deployments
Microsoft warns of high-severity flaw in hybrid Exchange deployments
bleepingcomputer.com - Microsoft has warned customers to mitigate a high-severity vulnerability in Exchange Server hybrid deployments that could allow attackers to escalate privileges in Exchange Online cloud environments undetected. Exchange hybrid configurations connect on-premises Exchange servers to Exchange Online (part of Microsoft 365), allowing for seamless integration of email and calendar features between on-premises and cloud mailboxes, including shared calendars, global address lists, and mail flow. However, in hybrid Exchange deployments, on-prem Exchange Server and Exchange Online also share the same service principal, which is a shared identity used for authentication between the two By abusing this shared identity, attackers who control the on-prem Exchange can potentially forge or manipulate trusted tokens or API calls that the cloud side will accept as legitimate, as it implicitly trusts the on-premises server. Additionally, actions originating from on-premises Exchange don't always generate logs associated with malicious behavior in Microsoft 365; therefore, traditional cloud-based auditing (such as Microsoft Purview or M365 audit logs) may not capture security breaches if they originated on-premises. "In an Exchange hybrid deployment, an attacker who first gains administrative access to an on-premises Exchange server could potentially escalate privileges within the organization's connected cloud environment without leaving easily detectable and auditable trace," Microsoft said on Wednesday in a security advisory describing a high-severity privilege escalation vulnerability now tracked as CVE-2025-53786. The vulnerability affects Exchange Server 2016 and Exchange Server 2019, as well as Microsoft Exchange Server Subscription Edition, the latest version, which replaces the traditional perpetual license model with a subscription-based one. While Microsoft has yet to observe in-the-wild exploitation, the company has tagged it as "Exploitation More Likely" because its analysis revealed that exploit code could be developed to consistently exploit this vulnerability, increasing its attractiveness to attackers.
#bleepingcomputer.com#EN#2025#CISA#Cloud#CVE-2025-53786#Elevation-of-Privileges#Microsoft#Microsoft-Exchange#Privilege-Escalation
·bleepingcomputer.com·
Microsoft warns of high-severity flaw in hybrid Exchange deployments
No Patch for Flaw Exposing Hundreds of LG Cameras to Remote Hacking
No Patch for Flaw Exposing Hundreds of LG Cameras to Remote Hacking
securityweek.com - LG Innotek LNV5110R security cameras are affected by a vulnerability that can be exploited for unauthenticated remote code execution. Hundreds of LG security cameras are vulnerable to remote hacking due to a recently discovered flaw and they will not receive a patch. The cybersecurity agency CISA revealed on Thursday that LG Innotek LNV5110R cameras are affected by an authentication bypass vulnerability that can allow an attacker to gain administrative access to the device. The flaw, tracked as CVE-2025-7742 and assigned a ‘high severity’ rating, can allow an attacker to upload an HTTP POST request to the device’s non-volatile storage, which can result in remote code execution with elevated privileges, according to CISA. LG Innotek has been notified, but said the vulnerability cannot be patched as the product has reached end of life. Souvik Kandar, the MicroSec researcher credited by CISA for reporting the vulnerability, told SecurityWeek there are roughly 1,300 cameras that are exposed to the internet and which can be remotely hacked.
#securityweek.com#EN#2025#LG#Innotek#Flaw#CVE-2025-7742#LNV5110R#security-cameras#CISA#vulnerables
·securityweek.com·
No Patch for Flaw Exposing Hundreds of LG Cameras to Remote Hacking
New Guidance Released for Reducing Memory-Related Vulnerabilities
New Guidance Released for Reducing Memory-Related Vulnerabilities
This joint guide highlights important considerations for organizations seeking to transition toward more secure software development practices Today, CISA, in partnership with the National Security Agency (NSA), released a joint guide on reducing memory-related vulnerabilities in modern software development. Memory safety vulnerabilities pose serious risks to national security and critical infrastructure. Adopting memory safe languages (MSLs) offers the most comprehensive mitigation against this class of vulnerabilities and provides built-in safeguards that enhance security by design. CISA’s Secure by Design program advocates for integrating proactive security measures throughout the software development lifecycle, with MSLs as a central component. Consistent support for MSLs underscores their benefits for national security and resilience by reducing exploitable flaws before products reach users. This joint guide outlines key challenges to adopting MSLs, offers practical approaches for overcoming them, and highlights important considerations for organizations seeking to transition toward more secure software development practices. Organizations in academia, U.S. government, and private industry are encouraged to review this guidance and support adoption of MSLs. In addition to the product published today, CISA and the NSA previously released the joint guide, The Case for Memory Safe Roadmaps. To learn more about memory safety, visit Secure by Design on CISA.gov. Please share your thoughts with us via our anonymous product survey; we welcome your feedback.
#cisa#EN#2025#Guidance#NSA#Memory-Related#Vulnerabilities#development
·cisa.gov·
New Guidance Released for Reducing Memory-Related Vulnerabilities
CISA: AMI MegaRAC bug enabling server hijacks exploited in attacks
CISA: AMI MegaRAC bug enabling server hijacks exploited in attacks
CISA says a maximum severity vulnerability in AMI's MegaRAC Baseboard Management Controller (BMC) software, which enables attackers to hijack and brick servers, is currently under active exploitation. CISA has confirmed that a maximum severity vulnerability in AMI's MegaRAC Baseboard Management Controller (BMC) software is now actively exploited in attacks. The MegaRAC BMC firmware provides remote system management capabilities for troubleshooting servers without being physically present, and it's used by several vendors (including HPE, Asus, and ASRock) that supply equipment to cloud service providers and data centers. This authentication bypass security flaw (tracked as CVE-2024-54085) can be exploited by remote unauthenticated attackers in low-complexity attacks that don't require user interaction to hijack and potentially brick unpatched servers.
#bleepingcomputer#EN#2025#Actively-Exploited#American-Megatrends-International#AMI#Authentication-Bypass#CISA#MegaRAC#CVE-2024-54085
·bleepingcomputer.com·
CISA: AMI MegaRAC bug enabling server hijacks exploited in attacks
La faille zero day Commvault ouvre la voie à une cascade d'exploits
La faille zero day Commvault ouvre la voie à une cascade d'exploits
L'agence de cybersécurité américaine s'inquiète de la capacité des pirates à tirer parti d'une vulnérabilité sévère affectant Commvault pour voler des secrets d'environnements applicatifs SaaS dont Microsoft 365. La CISA enjoint les entreprises à appliquer les correctifs disponibles. Régulièrement, la CISA lance des avertissement sur des failles exploitées. Selon un avis de l'agence de cybersécurité américaine, des acteurs malveillants pourraient avoir accédé à des secrets de clients à partir de la solution de sauvegarde Metallic Microsoft 365 de Commvault hébergée dans Azure. L'accès non autorisé à ces secrets a été réalisé grâce à un exploit zero day. En février, Microsoft a averti Commvault de l'existence d'une grave faille non spécifiée (répertoriée en tant que CVE-2025-3928) affectant sa solution Web Server. Par ailleurs, un acteur bénéficiant d'un soutien étatique l'exploitait activement pour accéder aux environnements Azure. Thomas Richards, directeur de la pratique de sécurité des infrastructures chez Black Duck, a déclaré que les flux SaaS sont intrinsèquement vulnérables. « Si les solutions SaaS déchargent les entreprises des tâches administratives liées à l'hébergement et à l'infrastructure, le revers de la médaille est que les sociétés n'ont aucun moyen de sécuriser ou de contrôler ces environnements », a-t-il déclaré. « Lorsque Commvault a été compromis, les victimes n'étaient même pas conscientes de l'existence d'une faille. » Une CVE-2023-3928 sévère Dans son avis, la CISA indique qu'elle soupçonne l'exploitation de CVE-2025-3928 de faire partie d'une campagne plus large visant les applications SaaS avec des paramètres par défaut et des autorisations de haut niveau. Commentant la note de la CISA, James Maude, Field CTO chez BeyondTrust, a déclaré : « Cela met en évidence les risques liés au fait de permettre à des tiers d'accéder de manière privilégiée à votre environnement, leur violation devenant votre violation [...] Alors que de nombreuses entreprises disposent de contrôles solides pour émettre et gérer l'accès aux comptes humains utilisés par les entrepreneurs et les tiers, l'histoire est souvent très différente lorsqu'il s'agit d'identités non humaines et de secrets qui permettent des interactions machine-machine. » D'après l'enquête de Commvault, les acteurs étatiques ont obtenu, par le biais d'un abus zero-day de CVE-2025-3928, un sous-ensemble d'identifiants d'applications que certains clients de Commvault utilisaient pour authentifier leurs environnements M365.
#lemondeinformatique#FR#2025#Commvault#CVE-2023-3928#CISA#faille#vulnérabilité#SaaS#dont#Microsoft365
·lemondeinformatique.fr·
La faille zero day Commvault ouvre la voie à une cascade d'exploits
Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers
Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers
The Likely Exploited Vulnerabilities (LEV) equations can help augment KEV- and EPSS-based remediation prioritization. Researchers from CISA and NIST have proposed a new cybersecurity metric designed to calculate the likelihood that a vulnerability has been exploited in the wild. Peter Mell of NIST and Jonathan Spring of CISA have published a paper describing equations for what they call Likely Exploited Vulnerabilities, or LEV. Thousands of vulnerabilities are discovered every year in software and hardware, but only a small percentage are ever exploited in the wild. Knowing which vulnerabilities have been exploited or predicting which flaws are likely to be exploited is important for organizations when trying to prioritize patching. Known Exploited Vulnerabilities (KEV) lists such as the one maintained by CISA and the Exploit Prediction Scoring System (EPSS), which relies on data to estimate the probability that a vulnerability will be exploited, can be very useful. However, KEV lists may be incomplete and EPSS may be inaccurate. LEV aims to enhance — not replace — KEV lists and EPSS. This is done through equations that take into account variables such as the first date when an EPSS score is available for a specified vulnerability, the date of the most recent KEV list update, inclusion in KEV, and the EPSS score for a given day (measured across multiple days). LEV probabilities can be useful for measuring the expected number and proportion of vulnerabilities that threat actors have exploited. It can also be useful for estimating the comprehensiveness of KEV lists. “Previously, KEV maintainers had no metric to demonstrate how close their list was to including all relevant vulnerabilities,” the researchers explained. In addition, LEV probabilities can help augment KEV- and EPSS-based vulnerability remediation prioritization — in the case of KEV by identifying higher-probability vulnerabilities that may be missing, and in the case of EPSS by finding vulnerabilities that may be underscored. While in theory LEV could turn out to be a very useful tool for vulnerability prioritization, the researchers pointed out that collaboration is necessary, and NIST is looking for industry partners “with relevant datasets to empirically measure the performance of LEV probabilities”.
#securityweek#EN#LEV#2025#KEV#CISA#NIST#introduced#metric#Likely#vulnerability#exploited
·securityweek.com·
Vulnerability Exploitation Probability Metric Proposed by NIST, CISA Researchers
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation CVE-2025-3248 Langflow Missing Authentication Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
#cisa#EN#KEV#2025#CVE-2025-3248#Langflow#Missing#Authentication#Vulnerability
·cisa.gov·
CISA Adds One Known Exploited Vulnerability to Catalog
CISA and FBI: Ghost ransomware breached orgs in 70 countries
CISA and FBI: Ghost ransomware breached orgs in 70 countries
CISA and the FBI said attackers deploying Ghost ransomware have breached victims from multiple industry sectors across over 70 countries, including critical infrastructure organizations. #CISA #Computer #Cring #Critical #FBI #Ghost #InfoSec #Infrastructure #Ransomware #Security
#bleepingcomputer#EN#2025#Ghost#Ransomware#Critical-Infrastructure#Cring#CISA#FBI
·bleepingcomputer.com·
CISA and FBI: Ghost ransomware breached orgs in 70 countries
2023 Top Routinely Exploited Vulnerabilities | CISA
2023 Top Routinely Exploited Vulnerabilities | CISA
In 2023, malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks compared to 2022, allowing them to conduct cyber operations against higher-priority targets. In 2023, the majority of the most frequently exploited vulnerabilities were initially exploited as a zero-day, which is an increase from 2022, when less than half of the top exploited vulnerabilities were exploited as a zero-day. Malicious cyber actors continue to have the most success exploiting vulnerabilities within two years after public disclosure of the vulnerability. The utility of these vulnerabilities declines over time as more systems are patched or replaced. Malicious cyber actors find less utility from zero-day exploits when international cybersecurity efforts reduce the lifespan of zero-day vulnerabilities.
#cisa#EN#2024#zero-day#vulnerabilities#2023#Routinely-Exploited
·cisa.gov·
2023 Top Routinely Exploited Vulnerabilities | CISA
Russian Military Cyber Actors Target US and Global Critical Infrastructure
Russian Military Cyber Actors Target US and Global Critical Infrastructure
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) assess that cyber actors affiliated with the Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm since at least 2020. GRU Unit 29155 cyber actors began deploying the destructive WhisperGate malware against multiple Ukrainian victim organizations as early as January 13, 2022. These cyber actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and Unit 74455.
#cisa#EN#2024#FBI#CISA#GRU#Global#Critical#Infrastructure#Unit29155#GRU-affiliated
·cisa.gov·
Russian Military Cyber Actors Target US and Global Critical Infrastructure
White House working on cyber insurance policy proposal for ‘catastrophic’ incidents
White House working on cyber insurance policy proposal for ‘catastrophic’ incidents
At the Black Hat cybersecurity conference on Thursday, National Cyber Director Harry Coker, Jr. said his office is working with the Department of Treasury’s federal insurance office as well as officials at the Cybersecurity and Infrastructure Security Agency (CISA) on the effort.
#therecord.media#EN#2024#cyber-insurance#policy#proposal#US#CISA
·therecord.media·
White House working on cyber insurance policy proposal for ‘catastrophic’ incidents
CISA confirms hackers may have accessed data from chemical facilities during January incident
CISA confirms hackers may have accessed data from chemical facilities during January incident
The agency found no evidence that hackers exfiltrated information but noted the intrusion “may have resulted in the potential unauthorized access” to security plans, vulnerability assessments and user accounts within a national system to protect the chemicals sector.
#therecord.media#EN#2024#CISA#confirms#hackers#CSAT#Critical-infrastructure
·therecord.media·
CISA confirms hackers may have accessed data from chemical facilities during January incident
2021 Top Routinely Exploited Vulnerabilities | CISA
2021 Top Routinely Exploited Vulnerabilities | CISA
This joint Cybersecurity Advisory (CSA) was coauthored by cybersecurity authorities of the United States, Australia, Canada, New Zealand, and the United Kingdom: the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS),
#cisa#uscert#csirt#cert#U.-S.-Computer-Emergency-Readiness#top#2021#top2021#EN#2022#Vulnerabilities
·cisa.gov·
2021 Top Routinely Exploited Vulnerabilities | CISA
NSA Releases Network Infrastructure Security Guidance
NSA Releases Network Infrastructure Security Guidance
The National Security Agency (NSA) has released a new Cybersecurity Technical Report (CTR): Network Infrastructure Security Guidance. The report captures best practices based on the depth and breadth of experience in supporting customers and responding to threats. Recommendations include perimeter and internal network defenses to improve monitoring and access controls throughout the network. PDF Document
#uscert#csirt#CISA#NSA#Guidance#Network#howto#bestpractices#2022#EN
·cisa.gov·
NSA Releases Network Infrastructure Security Guidance
Destructive Malware Targeting Organizations in Ukraine
Destructive Malware Targeting Organizations in Ukraine
Actions to Take Today: • Set antivirus and antimalware programs to conduct regular scans. • Enable strong spam filters to prevent phishing emails from reaching end users. • Filter network traffic. • Update software. • Require multifactor authentication. Leading up to Russia’s unprovoked attack against Ukraine, threat actors deployed destructive malware against organizations in Ukraine to destroy computer systems and render them inoperable. 
#uscert#csirt#cert#CISA#EN#2022#alert#WhisperGate#HermeticWiper#malware
·cisa.gov·
Destructive Malware Targeting Organizations in Ukraine