Feed aggregator
CISA Releases Seven Industrial Control Systems Advisories
Jul 9, 2024
CISA released seven Industrial Control Systems (ICS) advisories on July 9, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-191-01 Delta Electronics CNCSoft-G2 ICSA-24-191-02 Mitsubishi Electric MELIPC Series MI5122-VW ICSA-24-191-03 Johnson Controls Illustra Pro Gen 4 ICSA-24-191-04 Johnson Controls Software House C●CURE 9000 ICSA-24-191-05 Johnson Controls Software House C●CURE 9000 ICSA-24-177-02 PTC Creo Elements/Direct License Server (Update A) ICSA-23-269-03 Mitsubishi Electric FA Engineering Software (Update A) CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
Adobe Releases Security Updates for Multiple Products
Jul 9, 2024
Adobe released security updates to address multiple vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply necessary updates: Security Updates Available for Adobe Premiere Pro | APSB24-46 Security Update Available for Adobe InDesign | APSB24-48 Security Updates Available for Adobe Bridge | APSB24-51
CISA and Partners join ASD’S ACSC to Release Advisory on PRC State-Sponsored Group, APT 40
Jul 8, 2024
CISA has collaborated with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) to release an advisory, People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action outlining a PRC state-sponsored cyber group’s activity. The following organizations also collaborated with ASD's ACSC on the guidance: The National Security Agency (NSA); The Federal Bureau of Investigation (FBI); The United Kingdom’s National Cyber Security Centre (NCSC-UK); The Canadian Centre for Cyber Security (CCCS); The New Zealand National Cyber Security Centre (NCSC-NZ); The German Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution (BfV); The Republic of Korea’s National Intelligence Service (NIS) and NIS’ National Cyber Security Center (NCSC); and Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and National Policy Agency (NPA). The advisory is based on current ACSC-led incident response investigations and shared understanding of a PRC state-sponsored cyber group, APT40—also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk in industry reporting. APT 40 has previously targeted organizations in various countries, including Australia and the United States. Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs of concept (POCs) for targeting, reconnaissance, and exploitation operations. APT 40 identifies new exploits within widely used public software such as Log4J, Atlassian Confluence and Microsoft Exchange to target the infrastructure of the associated vulnerability. CISA urges all organizations and software manufacturers to review the advisory to help identify, prevent, and remediate APT 40 intrusions. Software vendors are also urged to incorporate Secure by Design principles into their practices to limit the impact of threat actor techniques and to strengthen the security posture of their products for their customers. For more information on PRC state-sponsored threat actor activity, see CISA’s People's Republic of China Cyber Threat. To learn more about secure by design principles and practices, visit CISA’s Secure by Design webpage.
CISA Releases Seven Industrial Control Systems Advisories
Jul 2, 2024
CISA released seven Industrial Control Systems (ICS) advisories on July 2, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-184-01 Johnson Controls Kantech Door Controllers ICSA-24-184-02 mySCADA myPRO ICSA-24-184-03 ICONICS and Mitsubishi Electric Products ICSA-24-179-04 Johnson Controls Illustra Essentials Gen 4 (Update A) ICSA-24-179-05 Johnson Controls Illustra Essentials Gen 4 (Update A) ICSA-24-179-06 Johnson Controls Illustra Essentials Gen 4 (Update A) ICSA-24-179-07 Johnson Controls Illustra Essentials Gen 4 (Update A) CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
CISA Adds One Known Exploited Vulnerability to Catalog
Jul 2, 2024
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-20399 Cisco NX-OS Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Juniper Networks Releases Security Bulletin for Junos OS: SRX Series
Jul 2, 2024
Juniper Networks released a security bulletin to address a vulnerability in Junos OS: SRX Series. A cyber threat actor could exploit this vulnerability to cause a denial-of-service condition. Users and administrators are encouraged to review the following and apply the necessary updates: JSA83195 Juniper Security Bulletin
Progress Software Releases Security Bulletin for MOVEit Transfer
Jun 28, 2024
Progress Software released a security bulletin to address a vulnerability in MOVEit Transfer. A cyber threat actor could exploit this vulnerability to take control of an affected system. Users and administrators are encouraged to review the following bulletin and apply the necessary updates: MOVEit Transfer Critical Security Alert Bulletin – June 2024 – (CVE-2024-5806)
CISA Releases Seven Industrial Control Systems Advisories
Jun 27, 2024
CISA released seven Industrial Control Systems (ICS) advisories on June 27, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-179-01 TELSAT marKoni FM Transmitter ICSA-24-179-02 SDG Technologies PnPSCADA ICSA-24-179-03 Yokogawa FAST/TOOLS and CI Server ICSA-24-179-04 Johnson Controls Illustra Essentials Gen 4 ICSA-24-179-05 Johnson Controls Illustra Essentials Gen 4 ICSA-24-179-06 Johnson Controls Illustra Essentials Gen 4 ICSA-24-179-07 Johnson Controls Illustra Essentials Gen 4 CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
CISA Adds Three Known Exploited Vulnerabilities to Catalog
Jun 26, 2024
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-24816 GeoSolutionsGroup JAI-EXT Code Injection Vulnerability CVE-2022-2586 Linux Kernel Use-After-Free Vulnerability CVE-2020-13965 Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
CISA and Partners Release Guidance for Exploring Memory Safety in Critical Open Source Projects
Jun 26, 2024
Today, CISA, in partnership with the Federal Bureau of Investigation, Australian Signals Directorate’s Australian Cyber Security Centre, and Canadian Cyber Security Center, released Exploring Memory Safety in Critical Open Source Projects. This guidance was crafted to provide organizations with findings on the scale of memory safety risk in selected open source software (OSS). This joint guidance builds on the guide The Case for Memory Safe Roadmaps by providing a starting point for software manufacturers to create memory safe roadmaps, including plans to address memory safety in external dependencies which commonly include OSS. Exploring Memory Safety in Critical Open Source Projects also aligns with the 2023 National Cybersecurity Strategy and corresponding implementation plan, which discusses investing in memory safety and collaborating with the open source community—including the establishment of the interagency Open Source Software Security Initiative (OS3I) and investment in memory-safe programming languages. CISA encourages all organizations and software manufacturers to review the methodology and results found in the guidance to: Reduce memory safety vulnerabilities; Make secure and informed choices; Understand the memory-unsafety risk in OSS; Evaluate approaches to reducing this risk; and Continue efforts to drive risk-reducing action by software manufacturers. To learn more about taking a top-down approach to developing secure products, visit CISA’s Secure by Design webpage.
CISA Releases Two Industrial Control Systems Advisories
Jun 25, 2024
CISA released two Industrial Control Systems (ICS) advisories on June 25, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-177-01 ABB Ability System 800xA ICSA-24-177-02 PTC Creo Elements/Direct License Server CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
Juniper Networks Releases Security Bulletin for Juniper Secure Analytics
Jun 21, 2024
Juniper Networks released a security bulletin to address multiple vulnerabilities affecting Juniper Secure Analytics optional applications. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following and apply the necessary updates: Juniper Security Bulletin JSA82681
CISA Releases Guidance on Single Sign-On (SSO) Adoption for Small and Medium-Sized Businesses: (SMBs)
Jun 20, 2024
Today, CISA released Barriers to Single Sign-On (SSO) Adoption for Small and Medium-Sized Businesses: Identifying Challenges and Opportunities, a detailed report exploring challenges to SSO adoption by small and medium-sized businesses (SMBs). The report also identifies potential ways to overcome these challenges and improve an SMB’s level of security. CISA also released a related blog post, Why SMBs Don’t Deploy Single Sign-On (SSO), urging software manufacturers to consider how their business practices may inadvertently reduce the security posture of their customers. For more information, visit CISA’s Secure by Design webpage. To learn more about identity and access management, visit Identity, Credential, and Access Management (ICAM).
CISA Releases Three Industrial Control Systems Advisories
Jun 20, 2024
CISA released three Industrial Control Systems (ICS) advisories on June 20, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-172-01 Yokogawa CENTUM ICSA-24-172-02 CAREL Boss-Mini ICSA-24-172-03 Westermo L210-F2G CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
CISA Releases One Industrial Control Systems Advisory
Jun 18, 2024
CISA released one Industrial Control Systems (ICS) advisory on June 18, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-170-01 RAD Data Communications SecFlow-2 CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
CISA and Partners Release Guidance for Modern Approaches to Network Access Security
Jun 18, 2024
Today, CISA, in partnership with the Federal Bureau of Investigation (FBI), released guidance, Modern Approaches to Network Access Security, along with the following organizations: New Zealand’s Government Communications Security Bureau (GCSB); New Zealand’s Computer Emergency Response Team (CERT-NZ); and The Canadian Centre for Cyber Security (CCCS). The guidance urges business owners of all sizes to move toward more robust security solutions—such as Zero Trust, Secure Service Edge (SSE), and Secure Access Service Edge (SASE)—that provide greater visibility of network activity. Additionally, this guidance helps organizations to better understand the vulnerabilities, threats, and practices associated with traditional remote access and VPN deployment, as well as the inherent business risk posed to an organization’s network by remote access misconfiguration. CISA and its partners encourage leaders to review the guidance to help with the prioritization and protection of remote computing environments. For more information and guidance on protection against the most common and impactful tactics, techniques, and procedures for network access security, visit CISA’s Cross-Sector Cybersecurity Performance Goals. For more information on zero trust, visit CISA’s Zero Trust Maturity Model.
CISA Adds Three Known Exploited Vulnerabilities to Catalog
Jun 13, 2024
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-32896 Android Pixel Privilege Escalation Vulnerability CVE-2024-26169 Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability CVE-2024-4358 Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
CISA Releases Twenty Industrial Control Systems Advisories
Jun 13, 2024
CISA released twenty Industrial Control Systems (ICS) advisories on June 13, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-165-01 Siemens Mendix Applications ICSA-24-165-02 Siemens SIMATIC S7-200 SMART Devices ICSA-24-165-03 Siemens TIA Administrator ICSA-24-165-04 Siemens ST7 ScadaConnect ICSA-24-165-05 Siemens SITOP UPS1600 ICSA-24-165-06 Siemens TIM 1531 IRC ICSA-24-165-07 Siemens PowerSys ICSA-24-165-08 Siemens Teamcenter Visualization and JT2Go ICSA-24-165-09 Siemens SICAM AK3/BC/TM ICSA-24-165-10 Siemens SIMATIC and SIPLUS ICSA-24-165-11 Siemens SCALANCE XM-400, XR-500 ICSA-24-165-12 Siemens SCALANCE W700 ICSA-24-165-13 Siemens SINEC Traffic Analyzer ICSA-24-165-14 Fuji Electric Tellus Lite V-Simulator ICSA-24-165-16 Rockwell Automation FactoryTalk View SE ICSA-24-165-17 Rockwell Automation FactoryTalk View SE ICSA-24-165-18 Rockwell Automation FactoryTalk View SE ICSA-24-165-19 Motorola Solutions Vigilant License Plate Readers ICSA-24-074-14 Mitsubishi Electric MELSEC-Q/L Series (Update B) ICSA-20-245-01 Mitsubishi Electric Multiple Products (Update G) CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Jun 12, 2024
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-4610 ARM Mali GPU Kernel Driver Use-After-Free Vulnerability CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Phone Scammers Impersonating CISA Employees
Jun 12, 2024
Impersonation scams are on the rise and often use the names and titles of government employees. The Cybersecurity and Infrastructure Security Agency (CISA) is aware of recent impersonation scammers claiming to represent the agency. As a reminder, CISA staff will never contact you with a request to wire money, cash, cryptocurrency, or use gift cards and will never instruct you to keep the discussion secret.If you suspect you are a target of an impersonation scammer claiming to be a CISA employee: • Do not pay the caller.• Take note of the phone number calling you.• Hang up immediately.• Validate the contact by calling CISA at (844) SAY-CISA (844-729-2472) or report it to law enforcement.
