Category: ICT

News In Brief – Source: US Computer Emergency Readiness Team

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 5.3
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Mitsubishi Electric Corporation
• Equipment: MELSEC iQ-F Series
• Vulnerability: Insufficient Resource Pool

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow a remote attacker to cause a temporary denial-of-service (DoS) condition for a certain period of time in the product’s Ethernet communication by performing a TCP SYN Flood attack.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Mitsubishi Electric MELSEC iQ-F Series, a compact control platform, are affected:

Products with * are sold in limited regions.

• MELSEC iQ-F FX5U-32MT/ES: All Versions
• MELSEC iQ-F FX5U-32MT/DS: All Versions
• MELSEC iQ-F FX5U-32MT/ESS: All Versions
• MELSEC iQ-F FX5U-32MT/DSS: All Versions
• MELSEC iQ-F FX5U-32MR/ES: All Versions
• MELSEC iQ-F FX5U-32MR/DS: All Versions
• MELSEC iQ-F FX5U-64MT/ES: All Versions
• MELSEC iQ-F FX5U-64MT/ESS: All Versions
• MELSEC iQ-F FX5U-64MT/DS: All Versions
• MELSEC iQ-F FX5U-64MT/DSS: All Versions
• MELSEC iQ-F FX5U-64MR/ES: All Versions
• MELSEC iQ-F FX5U-64MR/DS: All Versions
• MELSEC iQ-F FX5U-80MT/ES: All Versions
• MELSEC iQ-F FX5U-80MT/DS: All Versions
• MELSEC iQ-F FX5U-80MT/ESS: All Versions
• MELSEC iQ-F FX5U-80MT/DSS: All Versions
• MELSEC iQ-F FX5U-80MR/ES: All Versions
• MELSEC iQ-F FX5U-80MR/DS: All Versions
• MELSEC iQ-F FX5UC-32MT/D: All Versions
• MELSEC iQ-F FX5UC-32MT/DSS: All Versions
• MELSEC iQ-F FX5UC-64MT/D: All Versions
• MELSEC iQ-F FX5UC-64MT/DSS: All Versions
• MELSEC iQ-F FX5UC-96MT/D: All Versions
• MELSEC iQ-F FX5UC-96MT/DSS: All Versions
• MELSEC iQ-F FX5UC-32MT/DS-TS: All Versions
• MELSEC iQ-F FX5UC-32MT/DSS-TS: All Versions
• MELSEC iQ-F FX5UC-32MR/DS-TS: All Versions
• MELSEC iQ-F FX5UJ-24MT/ES: All Versions
• MELSEC iQ-F FX5UJ-24MT/DS: All Versions
• MELSEC iQ-F FX5UJ-24MT/ESS: All Versions
• MELSEC iQ-F FX5UJ-24MT/DSS: All Versions
• MELSEC iQ-F FX5UJ-24MR/ES: All Versions
• MELSEC iQ-F FX5UJ-24MR/DS: All Versions
• MELSEC iQ-F FX5UJ-40MT/ES: All Versions
• MELSEC iQ-F FX5UJ-40MT/DS: All Versions
• MELSEC iQ-F FX5UJ-40MT/ESS: All Versions
• MELSEC iQ-F FX5UJ-40MT/DSS: All Versions
• MELSEC iQ-F FX5UJ-40MR/ES: All Versions
• MELSEC iQ-F FX5UJ-40MR/DS: All Versions
• MELSEC iQ-F FX5UJ-60MT/ES: All Versions
• MELSEC iQ-F FX5UJ-60MT/DS: All Versions
• MELSEC iQ-F FX5UJ-60MT/ESS: All Versions
• MELSEC iQ-F FX5UJ-60MT/DSS: All Versions
• MELSEC iQ-F FX5UJ-60MR/ES: All Versions
• MELSEC iQ-F FX5UJ-60MR/DS: All Versions
• MELSEC iQ-F FX5UJ-24MT/ES-A*: All Versions
• MELSEC iQ-F FX5UJ-24MR/ES-A*: All Versions
• MELSEC iQ-F FX5UJ-40MT/ES-A*: All Versions
• MELSEC iQ-F FX5UJ-40MR/ES-A*: All Versions
• MELSEC iQ-F FX5UJ-60MT/ES-A*: All Versions
• MELSEC iQ-F FX5UJ-60MR/ES-A*: All Versions
• MELSEC iQ-F FX5S-30MT/ES: All Versions
• MELSEC iQ-F FX5S-30MT/ESS: All Versions
• MELSEC iQ-F FX5S-30MR/ES: All Versions
• MELSEC iQ-F FX5S-40MT/ES: All Versions
• MELSEC iQ-F FX5S-40MT/ESS: All Versions
• MELSEC iQ-F FX5S-40MR/ES: All Versions
• MELSEC iQ-F FX5S-60MT/ES: All Versions
• MELSEC iQ-F FX5S-60MT/ESS: All Versions
• MELSEC iQ-F FX5S-60MR/ES: All Versions
• MELSEC iQ-F FX5S-80*MT/ES: All Versions
• MELSEC iQ-F FX5S-80*MT/ESS: All Versions
• MELSEC iQ-F FX5S-80*MR/ES: All Versions

3.2 Vulnerability Overview

3.2.1 Insufficient Resource Pool CWE-410

In Mitsubishi Electric multiple FA products there is a denial-of-service (DoS) vulnerability that exists in the Ethernet function. A remote attacker could cause a temporary denial-of-service (DoS) condition for a certain period of time in the product’s Ethernet communication by performing a TCP SYN Flood attack.

CVE-2023-7033 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

Mitsubishi Electric Corporation reported this vulnerability to CISA.

4. MITIGATIONS

Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk of exploiting this vulnerability:

• Use a firewall, virtual private network (VPN) etc., to prevent unauthorized access when Internet access is required.
• Use within a LAN and block access from untrusted networks and hosts through firewalls.
• Use IP filter function to block access from untrusted hosts. For details on the IP filter function, please refer to the following manual for each product:
  “13.1 IP Filter Function” in the MELSEC iQ-F FX5 User’s Manual (Communication).
• Restrict physical access to the affected products and the LAN to which they are connected.

For specific update instructions and additional details refer to Mitsubishi Electric advisory 2023-023

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• February 27, 2024: Initial Publication

News In Brief – Source: US Computer Emergency Readiness Team

How SVR-Attributed Actors are Adapting to the Move of Government and Corporations to Cloud Infrastructure

OVERVIEW

This advisory details recent tactics, techniques, and procedures (TTPs) of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes, or Cozy Bear.

The UK National Cyber Security Centre (NCSC) and international partners assess that APT29 is a cyber espionage group, almost certainly part of the SVR, an element of the Russian intelligence services. The US National Security Agency (NSA), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Cyber National Mission Force (CNMF), the Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), and New Zealand Government Communications Security Bureau (GCSB) agree with this attribution and the details provided in this advisory.

This advisory provides an overview of TTPs deployed by the actor to gain initial access into the cloud environment and includes advice to detect and mitigate this activity.

To download the PDF version of this report, click here.

PREVIOUS ACTOR ACTIVITY

The NCSC has previously detailed how Russian Foreign Intelligence Service (SVR) cyber actors have targeted governmental, think tank, healthcare, and energy targets for intelligence gain. It has now observed SVR actors expanding their targeting to include aviation, education, law enforcement, local and state councils, government financial departments, and military organizations.

SVR actors are also known for:

EVOLVING TTPs

As organizations continue to modernize their systems and move to cloud-based infrastructure, the SVR has adapted to these changes in the operating environment.

They have to move beyond their traditional means of initial access, such as exploiting software vulnerabilities in an on-premises network, and instead target the cloud services themselves.

To access the majority of the victims’ cloud hosted network, actors must first successfully authenticate to the cloud provider. Denying initial access to the cloud environment can prohibit SVR from successfully compromising their target. In contrast, in an on-premises system, more of the network is typically exposed to threat actors.

Below describes in more detail how SVR actors are adapting to continue their cyber operations for intelligence gain. These TTPs have been observed in the last 12 months.

ACCESS VIA SERVICE AND DORMANT ACCOUNTS

Previous SVR campaigns reveal the actors have successfully used brute forcing [T1110] and password spraying to access service accounts. This type of account is typically used to run and manage applications and services. There is no human user behind them so they cannot be easily protected with multi-factor authentication (MFA), making these accounts more susceptible to a successful compromise. Service accounts are often also highly privileged depending on which applications and services they’re responsible for managing. Gaining access to these accounts provides threat actors with privileged initial access to a network, to launch further operations.

SVR campaigns have also targeted dormant accounts belonging to users who no longer work at a victim organization but whose accounts remain on the system [T1078.004].

Following an enforced password reset for all users during an incident, SVR actors have also been observed logging into inactive accounts and following instructions to reset the password. This has allowed the actor to regain access following incident response eviction activities.

CLOUD-BASED TOKEN AUTHENTICATION

Account access is typically authenticated by either username and password credentials or system-issued access tokens. The NCSC and partners have observed SVR actors using tokens to access their victims’ accounts, without needing a password [T1528].

The default validity time of system-issued tokens varies dependent on the system; however, cloud platforms should allow administrators to adjust the validity time as appropriate for their users. More information can be found on this in the mitigations section of this advisory.

ENROLLING NEW DEVICES TO THE CLOUD

On multiple occasions, the SVR have successfully bypassed password authentication on personal accounts using password spraying and credential reuse. SVR actors have also then bypassed MFA through a technique known as “MFA bombing” or “MFA fatigue,” in which the actors repeatedly push MFA requests to a victim’s device until the victim accepts the notification [T1621].

Once an actor has bypassed these systems to gain access to the cloud environment, SVR actors have been observed registering their own device as a new device on the cloud tenant [T1098.005]. If device validation rules are not set up, SVR actors can successfully register their own device and gain access to the network.

By configuring the network with device enrollment policies, there have been instances where these measures have defended against SVR actors and denied them access to the cloud tenant.

RESIDENTIAL PROXIES

As network-level defenses improve detection of suspicious activity, SVR actors have looked at other ways to stay covert on the internet. A TTP associated with this actor is the use of residential proxies [T1090.002]. Residential proxies typically make traffic appear to originate from IP addresses within internet service provider (ISP) ranges used for residential broadband customers and hide the true source. This can make it harder to distinguish malicious connections from typical users. This reduces the effectiveness of network defenses that use IP addresses as indicators of compromise, and so it is important to consider a variety of information sources such as application and host-based logging for detecting suspicious activity.

CONCLUSION

The SVR is a sophisticated actor capable of carrying out a global supply chain compromise such as the 2020 SolarWinds, however the guidance in this advisory shows that a strong baseline of cyber security fundamentals can help defend from such actors.

For organizations that have moved to cloud infrastructure, a first line of defense against an actor such as SVR should be to protect against SVR’s TTPs for initial access. By following the mitigations outlined in this advisory, organizations will be in a stronger position to defend against this threat.

Once the SVR gain initial access, the actor is capable of deploying highly sophisticated post compromise capabilities such as MagicWeb, as reported in 2022. Therefore, mitigating against the SVR’s initial access vectors is particularly important for network defenders.

CISA have also produced guidance through their Secure Cloud Business Applications (SCuBA) Project which is designed to protect assets stored in cloud environments.

Some of the TTPs listed in this report, such as residential proxies and exploitation of system accounts, are similar to those reported as recently as January 2024 by Microsoft.

MITRE ATT&CK®

This report has been compiled with respect to the MITRE ATT&CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

Tactic	ID	Technique	Procedure
Credential Access	T1110	Brute Force	The SVR use password spraying and brute forcing as an initial infection vector.
Initial Access	T1078.004	Valid Accounts: Cloud Accounts	The SVR use compromised credentials to gain access to accounts for cloud services, including system and dormant accounts.
Credential Access	T1528	Steal Application Access Token	The SVR use stolen access tokens to login to accounts without the need for passwords.
Credential Access	T1621	Multi-Factor Authentication Request Generation	The SVR repeatedly push MFA requests to a victim’s device until the victim accepts the notification, providing SVR access to the account.
Command and Control	T1090.002	Proxy: External Proxy	The SVR use open proxies in residential IP ranges to blend in with expected IP address pools in access logs.
Persistence	T1098.005	Account Manipulation: Device Registration	The SVR attempt to register their own device on the cloud tenant after acquiring access to accounts.

MITIGATION AND DETECTION

A number of mitigations will be useful in defending against the activity described in this advisory: 

• Use multi-factor authentication (/2-factor authentication/two-step verification) to reduce the impact of password compromises. See NCSC guidance: Multifactor Authentication for Online Services and Setting up 2-Step Verification (2SV).
• Accounts that cannot use 2SV should have strong, unique passwords. User and system accounts should be disabled when no longer required with a “joiners, movers, and leavers” process in place and regular reviews to identify and disable inactive/dormant accounts. See NCSC guidance: 10 Steps to Cyber Security.
• System and service accounts should implement the principle of least privilege, providing tightly scoped access to resources required for the service to function.
• Canary service accounts should be created which appear to be valid service accounts but are never used by legitimate services. Monitoring and alerting on the use of these account provides a high confidence signal that they are being used illegitimately and should be investigated urgently.
• Session lifetimes should be kept as short as practical to reduce the window of opportunity for an adversary to use stolen session tokens. This should be paired with a suitable authentication method that strikes a balance between regular user authentication and user experience.
• Ensure device enrollment policies are configured to only permit authorized devices to enroll. Use zero-touch enrollment where possible, or if self-enrollment is required then use a strong form of 2SV that is resistant to phishing and prompt bombing. Old devices should be prevented from (re)enrolling when no longer required. See NCSC guidance: Device Security Guidance.
• Consider a variety of information sources such as application events and host-based logs to help prevent, detect and investigate potential malicious behavior. Focus on the information sources and indicators of compromise that have a better rate of false positives. For example, looking for changes to user agent strings that could indicate session hijacking may be more effective than trying to identify connections from suspicious IP addresses. See NCSC guidance: Introduction to Logging for Security Purposes.

DISCLAIMER

This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times.

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.

Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk.

All material is UK Crown Copyright.

News In Brief – Source: US Computer Emergency Readiness Team

CISA, in partnership with UK National Cyber Security Centre (NCSC) and other U.S. and international partners released the joint advisory, SVR Cyber Actors Adapt Tactics for Initial Cloud Access. This advisory provides recent tactics, techniques, and procedures (TTPs) used by Russian Foreign Intelligence Service (SVR) cyber actors—also known as APT29, the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard—to gain initial access into a cloud environment.

The authoring agencies encourage network defenders and organizations review the joint advisory for recommended mitigations. For more information on APT29, see joint CSA Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally or visit CISA’s Russia Cyber Threat Overview and Advisories page. For more guidance on cloud security best practices, see CISA’s Secure Cloud Business Applications (SCuBA) Project.

News In Brief – Source: US Computer Emergency Readiness Team

Today, CISA, the Environmental Protection Agency (EPA), and the Federal Bureau of Investigation (FBI) updated the joint fact sheet Top Cyber Actions for Securing Water Systems. This update includes additional resources—from American Water Works Association, the WaterISAC, and MS-ISAC—to support water systems in defending against from malicious cyber activity. 

The fact sheet outlines the following practical actions Water and Wastewater Systems (WWS) Sector entities can take to better protect water systems from malicious cyber activity and provides actionable guidance to implement concurrently:

• Reduce Exposure to the Public-Facing Internet
• Conduct Regular Cybersecurity Assessments
• Change Default Passwords Immediately
• Conduct an Inventory of Operational Technology/Information Technology Assets
• Develop and Exercise Cybersecurity Incident Response and Recovery Plans
• Backup OT/IT Systems
• Reduce Exposure to Vulnerabilities
• Conduct Cybersecurity Awareness Training

CISA, EPA, and FBI urge all WWS Sector and critical infrastructure organizations to review the fact sheet and implement the actions to improve resilience to cyber threat activity. Organizations can visit cisa.gov/water for additional sector tools, information, and resources.

News In Brief – Source: US Computer Emergency Readiness Team

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 7.8
• ATTENTION: Low attack complexity
• Vendor: Delta Electronics
• Equipment: CNCSoft-B DOPSoft
• Vulnerability: Uncontrolled Search Path Element

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Delta Electronics products are affected:

• CNCSoft-B v1.0.0.4 DOPSoft: versions prior to v4.0.0.82

3.2.1 UNCONTROLLED SEARCH PATH ELEMENT CWE-427

The affected product insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed.

CVE-2024-1595 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Taiwan

3.4 RESEARCHER

Delta Electronics reported this vulnerability to CISA.

4. MITIGATIONS

Delta recommends users upgrade to CNCSoft-B v1.0.0.4, which includes DOPSoft v4.0.0.94.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• February 22, 2024: Initial Publication

News In Brief – Source: US Computer Emergency Readiness Team

Mozilla released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system.

CISA encourages users and administrators to review the following Mozilla Security Advisories and apply the necessary updates:

News In Brief – Source: US Computer Emergency Readiness Team

 New logging increases security by default and enhances cyber defense 

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA), Office of Management and Budget (OMB), Office of the National Cyber Director (ONCD) and Microsoft announce today further progress in ensuring that Federal Civilian Executive Branch (FCEB) agencies have access to necessary logging capabilities. Over the past six months, Microsoft has worked closely with CISA, OMB, and ONCD to roll out expanded logs to a pilot group of agencies. Beginning this month, expanded logging will be available to all agencies using Microsoft Purview Audit regardless of license tier.

As described in CISA’s Secure by Design guidance, all technology providers should provide “high-quality audit logs to customers at no extra charge or additional configuration.” Today’s announcement is a further step in this direction. Microsoft will automatically enable the logs in customer accounts and increase the default log retention period from 90 days to 180 days. Also, this data will provide new telemetry to help more federal agencies meet logging requirements mandated by OMB Memorandum M-21-31.

To help agencies more effectively use available logs to detect and remediate cyber threats, CISA has developed a new Expanded Cloud Log Implementation Playbook in close coordination with Microsoft, which provides further detail on each newly available log and how these logs can be used to support threat hunting and incident-response operations. 

“Last summer, we were glad to see Microsoft’s commitment to make necessary logging available to federal agencies and the broader cybersecurity community. I am pleased that we have made real progress toward this goal,” said CISA Executive Assistant Director for Cybersecurity Eric Goldstein. “We look forward to continued progress with our partners to ensure that every organization has access to necessary security logs– a core tenet of our Secure by Design guidance in support of the National Cybersecurity Strategy. Every organization has the right to safe and secure technology, and we continue to make progress toward this goal.”

“As the federal government continues our transition to cloud environments, we must ensure we are following secure-by-design and secure-by-default principles,” said Chris DeRusha, Federal Chief Information Security Officer and Deputy National Cyber Director. “The upgraded logging features now available to Microsoft’s government community cloud customers will provide greater visibility, and enable our network defenders to enhance their threat detection capabilities.”

“We recognize the vital importance that advanced logging plays in enabling federal agencies to detect, respond to, and prevent even the most sophisticated cyberattacks from well-resourced, state-sponsored actors. For this reason, we have been collaborating across the federal government to provide access to advanced audit logs,” said Candice Ling, Senior Vice President, Microsoft Federal. “Microsoft will continue to play a critical role in partnering with the federal government to reinforce our commitment to secure by design and further enhance the security baseline of our nation.”

In July 2023, a federal agency observed suspicious, unexpected activity in unclassified Microsoft 365 audit logs and reported it to Microsoft and CISA. The agency detected the activity using one of the logs Microsoft is expanding access to with this announcement. The importance of having critical cybersecurity logs that provided timely information was clearly demonstrated by this incident. CISA continues our work to ensure every organization has access to key security data by default so they can better defend their networks from malicious cyber actors.

For more details on this announcement, read Microsoft’s blog and visit CISA’s Secure by Design webpage for more information.

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on Twitter, Facebook, LinkedIn, Instagram. 

News In Brief – Source: US Computer Emergency Readiness Team

CISA released three Industrial Control Systems (ICS) advisories on February 20, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.

News In Brief – Source: US Computer Emergency Readiness Team

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 9.8
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Mitsubishi Electric Corporation
• Equipment: Electrical discharge machines
• Vulnerability: Improper Input Validation

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to disclose, tamper with, destroy or delete information in the products, or cause a denial-of-service condition on the products.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Mitsubishi Electric reports that the following electrical discharge machines are affected by this vulnerability in Microsoft Message Queuing service:

• Wire-cut EDM MV Series MV1200S D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MV Series MV2400S D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MV Series MV4800S D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MV Series MV1200R D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MV Series MV2400R D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MV Series MV4800R D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MV Series MV1200S D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MV Series MV2400S D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MV Series MV4800S D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MV Series MV1200R D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MV Series MV2400R D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MV Series MV4800R D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MP Series MP1200 D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MP Series MP2400 D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MP Series MP4800 D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MP Series MP1200 D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MP Series MP2400 D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MP Series MP4800 D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MX Series MX900 D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MX Series MX2400 D-CUBES Series Standard system BRD-B60W000-**: all versions
• Wire-cut EDM MX Series MX900 D-CUBES Series Special system BRD-B63W+++-**: all versions
• Wire-cut EDM MX Series MX2400 D-CUBES Series Special system BRD-B63W+++-**: all versions
• Sinker EDM SV-P Series SV8P D-CUBES Series Standard system BRD-M60W000-**: all versions
• Sinker EDM SV-P Series SV12 D-CUBES Series Standard system BRD-M60W000-**: all versions
• Sinker EDM SV-P Series SV8P D-CUBES Series Special system BRD-M63W+++-**: all versions
• Sinker EDM SV-P Series SV12 D-CUBES Series Special system BRD-M63W+++-**: all versions
• Sinker EDM SG Series SG8 D-CUBES Series Standard system BRD-M60W000-**: all versions
• Sinker EDM SG Series SG12 D-CUBES Series Standard system BRD-M60W000-**: all versions
• Sinker EDM SG Series SG28 D-CUBES Series Standard system BRD-M60W000-**: all versions
• Sinker EDM SG Series SG8 D-CUBES Series Special system BRD-M63W+++-**: all versions
• Sinker EDM SG Series SG12 D-CUBES Series Special system BRD-M63W+++-**: all versions
• Sinker EDM SG Series SG28 D-CUBES Series Special system BRD-M63W+++-**: all versions

3.2 Vulnerability Overview

3.2.1 Improper Input Validation CWE-20

Remote code execution vulnerability due to Microsoft Message Queuing service on Microsoft Windows exists in electrical discharge machines.

CVE-2023-21554 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

Mitsubishi Electric reported this vulnerability to CISA.

4. MITIGATIONS

Mitsubishi Electric recommends that users install the latest update. For information about how to install the update program, please contact your local service center.

Mitsubishi Electric recommends taking the mitigations listed below to minimize the risk of exploitation of this vulnerability.

• Use a firewall, virtual private network (VPN) etc., to prevent unauthorized access when Internet access is required.
• Use within a LAN and block access from untrusted networks and hosts through firewalls.
• Restrict physical access to the affected products and to personal computers and network devices that can communicate with them.
• Install anti-virus software on personal computers that can communicate with the affected products.

For specific update instructions and additional details refer to Mitsubishi Electric advisory 2023-022.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability) has been reported to CISA at this time.

5. UPDATE HISTORY

• February 20, 2024: Initial Publication

News In Brief – Source: US Computer Emergency Readiness Team

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global). 

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 9.8
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Siemens
• Equipment: SCALANCE W1750D
• Vulnerabilities: Classic Buffer Overflow, Improper Input Validation, Command Injection

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to sensitive information disclosure, unauthenticated denial-of-service or unauthenticated remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following products of Siemens, are affected:

• SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0): All versions
• SCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0): All versions
• SCALANCE W1750D (USA) (6GK5750-2HX01-1AB0): All versions

3.2 Vulnerability Overview

3.2.1 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT (‘CLASSIC BUFFER OVERFLOW’) CWE-120

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba’s access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2023-45614 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.2 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT (‘CLASSIC BUFFER OVERFLOW’) CWE-120

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba’s access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2023-45615 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.3 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT (‘CLASSIC BUFFER OVERFLOW’) CWE-120

There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba’s access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2023-45616 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.4 IMPROPER INPUT VALIDATION CWE-20

There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba’s access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

CVE-2023-45617 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

3.2.5 IMPROPER INPUT VALIDATION CWE-20

There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba’s access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

CVE-2023-45618 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

3.2.6 IMPROPER INPUT VALIDATION CWE-20

There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba’s access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

CVE-2023-45619 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

3.2.7 IMPROPER INPUT VALIDATION CWE-20

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45620 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.8 IMPROPER INPUT VALIDATION CWE-20

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45621 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.9 IMPROPER INPUT VALIDATION CWE-20

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45622 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.10 IMPROPER INPUT VALIDATION CWE-20

Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45623 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.11 IMPROPER INPUT VALIDATION CWE-20

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45624 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.12 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND (‘COMMAND INJECTION’) CWE-77

Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2023-45625 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

3.2.13 IMPROPER INPUT VALIDATION CWE-20

An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

CVE-2023-45626 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

3.2.14 IMPROPER INPUT VALIDATION CWE-20

An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45627 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Multiple
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens ProductCERT reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

• CVE-2023-45614, CVE-2023-45615, CVE-2023-45616, CVE-2023-45617, CVE-2023-45618, CVE-2023-45619, CVE-2023-45620, CVE-2023-45621, CVE-2023-45622, CVE-2023-45623, CVE-2023-45624: Enabling cluster-security via the cluster-security command will prevent the vulnerabilities from being exploited.
• CVE-2023-45625, CVE-2023-45626, CVE-2023-45627: The CLI and web-based management interfaces should be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see the associated Siemens security advisory SSA-716164 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

• February 15, 2024: Initial Publication