A recent Cyble ICS vulnerabilities report sheds light on several critical vulnerabilities in industrial control systems (ICS) from major vendors including Schneider Electric, mySCADA, and Automated Logic.
These vulnerabilities, some of which are categorized as high risk, expose systems in critical sectors such as manufacturing, energy, and communications to serious threats. Organizations are being urged to take immediate action to patch the flaws, with guidance provided by the Cybersecurity and Infrastructure Security Agency (CISA).
The report, compiled by Cyble Research and Intelligence Labs (CRIL), identifies vulnerabilities that could allow attackers to breach sensitive systems and disrupt critical operations. CISA issued advisories for a total of 15 vulnerabilities across various ICS products.
Among the most concerning vulnerabilities identified are CVE-2024-10575, CVE-2024-47407, and CVE-2024-8525. These flaws affect critical infrastructure, including SCADA and building automation systems.
In addition to these critical flaws, the report also identifies CVE-2024-8933 in Schneider Electric’s Modicon M340, MC80, and Momentum systems, which involves message integrity bypass. Additionally, CVE-2024-50054 in mySCADA’s myPRO Manager/Runtime involves a path traversal issue, which could lead to unauthorized file access.
Schneider Electric accounted for 50% of the reported vulnerabilities, primarily affecting industrial automation and energy management systems. mySCADA contributed 33% of the vulnerabilities, affecting SCADA and HMI systems. Automated Logic and CODESYS GmbH represented 17%, with flaws impacting building automation and PLC software.
These vulnerabilities have wide-ranging consequences for the critical infrastructure sectors, especially in manufacturing, energy, and communications, which together accounted for the majority of the reported issues.
CISA plays a vital role in identifying and addressing ICS vulnerabilities, offering advisories to help organizations mitigate risks. To enhance ICS security, organizations should monitor alerts, adopt zero-trust architectures, segment networks, and implement strong patch management strategies.
Regular vulnerability assessments, secure access protocols, and incident response plans are essential for quick recovery from potential attacks. Additionally, ongoing employee training on cybersecurity best practices is crucial. The recent vulnerabilities in Schneider Electric, mySCADA, and Automated Logic emphasize the need for timely patching and proactive security measures to protect critical infrastructure from evolving cyber threats.
A decade-old PHP flaw found by AI, 1,462 arrests across Africa and fake UAE driving licenses: the top cybersecurity stories…
The FTC also states that it will never demand money, threaten consumers, instruct them to transfer money or promise them…
A cybercrime crackdown in 21 countries saw 1,462 arrests, 10,909 networks disrupted and over USD 105 million recovered under Operation…
Japan plans AI cyberattack simulations after PHP flaws sparked millions of hacking attempts and forced banks, railways and agencies to…
For fintech businesses, resilience depends not only on the services they build, but also on the software foundations they can…
For security teams, Cyble advises monitoring public code and newly registered domains for their own keys and webhooks.
This website uses cookies. By continuing to use this website you are giving consent to cookies being used.
Read More