Szolgáltatóknak

When fire ignited during Technical Solutions Architect Rick B.'s family vacation, they joined in to help the Hawaii they love, knowing Cisco had their backs.

Hear more about the challenges, trends and opportunities facing today’s healthcare cybersecurity leaders in this podcast episode with Becker's Healthcare.

I’ve never had the intention to join the technology industry, in fact, I had never even heard of Cisco up until a couple of months before I joined the company, and now it’s been 27 years since I first started! In the multiple career development sessions that I have been a part of at Cisco, there were some recurrent questions and themes addressed, this is how I would summarise them.

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: InfraSuite Device Master Vulnerabilities: Path Traversal, Deserialization of Untrusted Data, Exposed Dangerous Method or Function. 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to remotely execute arbitrary code and obtain plaintext credentials. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Delta Electronics products are affected: InfraSuite Device Master: Versions 1.0.7 and prior 3.2 Vulnerability Overview 3.2.1 PATH TRAVERSAL CWE-35 In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to remote code execution. CVE-2023-46690 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). 3.2.2 DESERIALIZATION OF UNTRUSTED DATA CWE-502 In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator privileges. CVE-2023-47207 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 3.2.3 EXPOSED DANGEROUS METHOD OR FUNCTION CWE-749 In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a single UDP packet. CVE-2023-39226 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 3.2.4 PATH TRAVERSAL CWE-35 In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying. CVE-2023-47279 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Taiwan 3.4 RESEARCHER hir0ot and Piotr Bazydlo (@chudypb) working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA. 4. MITIGATIONS Delta Electronics recommends updating their software to v1.0.10 or later. CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. 5. UPDATE HISTORY November 28, 2023: Initial Publication

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.4 ATTENTION: Low attack complexity Vendor: Becton, Dickinson and Company (BD) Equipment: FACSChorus Vulnerabilities: Missing Protection Mechanism for Alternate Hardware Interface, Missing Authentication for Critical Function, Improper Authentication, Use of Hard-coded Credentials, Insecure Inherited Permissions, 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker with physical access to the device to modify system configurations, obtain access to sensitive information, or access components of the system. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following BD products are affected: BD FACSChorus (HP Z2 G9 workstation, shipped with FACSDiscover S8 Cell Sorter): v5.0 and v5.1 BD FACSChorus (HP Z2 G5 workstation, shipped with FACSMelody Cell Sorter): v3.0 and v3.1 3.2 Vulnerability Overview 3.2.1 MISSING PROTECTION MECHANISM FOR ALTERNATE HARDWARE INTERFACE CWE-1299 In BD FACSChorus v5.0, v5.1, v3.0, and v3.1, the respective workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data. CVE-2023-29060 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.4 has been calculated; the CVSS vector string is ( AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). 3.2.2 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306 In the BD FACSChorus v5.0, v5.1, v3.0, and v3.1 workstation, there is no BIOS password. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication. CVE-2023-29061 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.2 has been calculated; the CVSS vector string is ( AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). 3.2.3 IMPROPER AUTHENTICATION CWE-287 In BD FACSChorus v5.0, v5.1, v3.0, and v3.1, the operating system hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems. CVE-2023-29062 has been assigned to this vulnerability. A CVSS v3.1 base score of 3.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). 3.2.4 MISSING PROTECTION MECHANISM FOR ALTERNATE HARDWARE INTERFACE CWE-1299 In BD FACSChorus v5.0, v5.1, v3.0, and v3.1, the workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup. CVE-2023-29063 has been assigned to this vulnerability. A CVSS v3.1 base score of 2.4 has been calculated; the CVSS vector string is ( AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). 3.2.5 USE OF HARD-CODED CREDENTIALS CWE-798 In BD FACSChorus v5.0 and v5.1, the software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts. CVE-2023-29064 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.1 has been calculated; the CVSS vector string is ( AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). 3.2.6 INSECURE INHERITED PERMISSIONS CWE-277 In BD FACSChorus v5.0 and v5.1, the software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database. CVE-2023-29065 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.1 has been calculated; the CVSS vector string is ( AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). 3.2.7 INCORRECT PRIVILEGE ASSIGNMENT CWE-266 In BD FACSChorus v5.0 and v5.1 and the respective workstations, the software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders. CVE-2023-29066 has been assigned to this vulnerability. A CVSS v3.1 base score of 3.2 has been calculated; the CVSS vector string is ( AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: United States 3.4 RESEARCHER Michael Aguilar (v3ga) of Secureworks, Milind Sunilbhai Purswani and BD reported these vulnerabilities to CISA. 4. MITIGATIONS Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates. BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin: Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation. If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed. Administrative access to the FACSChorus software and workstation should be strictly controlled by the user in collaboration with their local IT security policy. The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter. For additional information, refer to BD's Security Bulletin. CISA recommends users take defensive measures to minimize the risk of exploitation of this these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. 5. UPDATE HISTORY November 28, 2023: Initial Publication

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Franklin Electric Fueling Systems Equipment: Colibri Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain login credentials for other users. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of FFS Colibri, a discontinued fuel inventory monitoring system, are affected: FFS Colibri: all versions. 3.2 Vulnerability Overview 3.2.1 Path Traversal CWE-35 The discontinued FFS Colibri product allows a remote user to access files on the system including files containing login credentials for other users. CVE-2023-5885 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Energy COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: United States 3.4 RESEARCHER Momen Eldawakhly Samurai Digital Security Ltd. reported this vulnerability to CISA. 4. MITIGATIONS Franklin Electric Fueling Systems determined that the vulnerability only affects the Colibri product which has not been sold since 2020 and does not affect the current EVO product lines. They created a firmware update for Colibri to address the issue. Users can download the update at from the Franklin Electric website. Franklin Electric is working with distributors to make sure all known users are aware that the update is available for installation. For further information, please contact Franklin Electric Fueling Systems. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. Exercise principles of least privilege. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 5. UPDATE HISTORY November 28, 2023: Initial Publication

CISA released four Industrial Control Systems (ICS) advisories on November 28, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-331-01 Delta Electronics InfraSuite Device Master ICSA-23-331-02 Franklin Electric Fueling Systems Colibri ICSA-23-331-03 Mitsubishi Electric GX Works2 ICSMA-23-331-01 BD FACSChorus CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 2.9 ATTENTION: Exploitable locally Vendor: Mitsubishi Electric Corporation Equipment: GX Works2 Vulnerability: Denial-of-Service 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a Denial-of-service (DoS) due to improper input validation in the simulation function of GX Works2 by sending specially crafted packets. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS GX Works2: all versions 3.2 Vulnerability Overview 3.2.1 Improper Input Validation CWE-20 An attacker may be able to cause denial-of-service (DoS) condition on the function by sending specially crafted packets. However, the attacker would need to send the packets from within the same personal computer where the function is running. CVE-2023-5274 has been assigned to this vulnerability. A CVSS v3.1 base score of 2.9 has been calculated; the CVSS vector string is ( AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). 3.2.2 Improper Input Validation CWE-20 An attacker may be able to cause denial-of-service (DoS) condition on the function by sending specially crafted packets. However, the attacker would need to send the packets from within the same personal computer where the function is running. CVE-2023-5275 has been assigned to this vulnerability. A CVSS v3.1 base score of 2.9 has been calculated; the CVSS vector string is ( AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Japan 3.4 RESEARCHER joker63 of ZheJiangQiAnTechnology reported these vulnerabilities to Mitsubishi Electric. 4. MITIGATIONS Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk of exploiting this vulnerability: Install an antivirus software in your personal computer using the affected product. Use your personal computer with the affected product within the LAN and block remote login from untrusted networks, hosts, and users. When connecting your personal computer with the affected product to the Internet, use a firewall, virtual private network (VPN), etc., to prevent unauthorized access, and allow only trusted users to remote login. Don't open untrusted files or click untrusted links. For more information, see the Mitsubishi security advisory. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. These vulnerabilities have a high attack complexity. 5. UPDATE HISTORY November 28, 2023: Initial Publication

CISA is responding to active exploitation of Unitronics programmable logic controllers (PLCs) used in the Water and Wastewater Systems (WWS) Sector. Cyber threat actors are targeting PLCs associated with WWS facilities, including an identified Unitronics PLC, at a U.S. water facility. In response, the affected municipality’s water authority immediately took the system offline and switched to manual operations—there is no known risk to the municipality’s drinking water or water supply. WWS Sector facilities use PLCs to control and monitor various stages and processes of water and wastewater treatment, including turning on and off pumps at a pump station to fill tanks and reservoirs, flow pacing chemicals to meet regulations, gathering compliance data for monthly regulation reports, and announcing critical alarms to operations. Attempts to compromise WWS integrity via unauthorized access threaten the ability of WWS facilities to provide clean, potable water to, and effectively manage the wastewater of, their communities. The cyber threat actors likely accessed the affected device—a Unitronics Vision Series PLC with a Human Machine Interface (HMI)—by exploiting cybersecurity weaknesses, including poor password security and exposure to the internet. To secure WWS facilities against this threat, CISA urges organizations to: Change the Unitronics PLC default password—validate that the default password “1111” is not in use. Require multifactor authentication for all remote access to the OT network, including from the IT network and external networks. Disconnect the PLC from the open internet. If remote access is necessary, implement a Firewall/VPN in front of the PLC to control network access to the remote PLC. A VPN or gateway device can enable multifactor authentication for remote access even if the PLC does not support multifactor authentication. Unitronics also has a secure cellular based longhaul transport device that is secure to their cloud services. Back up the logic and configurations on any Unitronics PLCs to enable fast recovery. Become familiar with the process for factory resetting and deploying configurations to a device in the event of being hit by ransomware. If possible, utilize a TCP port that is different than the default port TCP 20256. Cyber actors are actively targeting TCP 20256 after identifying it through network probing as a port associated to Unitronics PLC. Once identified, they leverage scripts specific to PCOM/TCP to query and validate the system, allowing for further probing and connection. If available, use PCOM/TCP filters to parse out the packets. Update PLC/HMI to the latest version provided by Unitronics. CISA and WWS Sector partners have developed numerous tools and resources that water utilities can use to increase their cybersecurity. Please visit: CISA: Water and Wastewater Cybersecurity EPA: Cybersecurity for the Water Sector WaterISAC: Resource Center American Water Works Association: Cybersecurity and Guidance Report All organizations should report suspicious or criminal activity related to information found in this Alert by contacting CISA’s 24/7 Operations Center at report@cisa.gov or (888) 282-0870, or your local FBI field office.