Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-32284PUBLISHED: 2022-07-04Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D, which may allow a remote attacker to cause denial-of-service (DoS) condition by sending a specially crafted packet.
CVE-2022-33208PUBLISHED: 2022-07-04
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sy...
CVE-2022-33948PUBLISHED: 2022-07-04HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may execute an arbitrary OS command on the product if a malicious DHCP server is placed on the WAN side of the product.
CVE-2022-33971PUBLISHED: 2022-07-04
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an ...
CVE-2022-34151PUBLISHED: 2022-07-04
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studi...
User Rank: Ninja
6/20/2019 | 5:53:13 PM
-> Blocking overseas addresses at the ISP layer
-> Create a security dashboard where threat intelligence is shared amoung energy companies, this prescriptive procedure allows organizations who are on the grid to keep ahead of the game especially when actors attack a specific site and they can view the remedy on how to thwart the attack
-> Utilize IPv6 as a way to communicate over the web using IPSec AES256 ESP/AH tunnels
-> Work with IBM and Deep Learning to identify the vulnerabilities in real-time (machine learning at the highest level)
-> Take the best of all Hardened linux machines and create a parallel processing OS that uses docker containers for application level processing where changes are made within a specific time period
-> Simultaneous authorization - Keys are unclocked by two people (similar to nuclear authorization)
-> Distributed NMS network is used to monitor traffic and external communication, anything not on the grid, it gets blocked
-> IP address range limited to devices that are allowed on the network (IPv6 only), only external power companies are able to communicate with the grid and their location is verified by GPS tracking system, if the object moves (routers/switches/firewalls, then someone is notified).
-> Cloud is used as a backup and/or DR resource if the onsite system is compromised, the command and control of the ICS environment can be moved to the cloud (direct connect to multiple CSP - Cloud Service Providers).
-> System recovery should be done in minutes instead of hours
By the way, Schneider Electric was the company who reported on it, AIM Triton overflow was affected
A Windows resolution to address it would be to run the following (complete analysis - https://bit.ly/2XeECIS)
Block Triton ICS Port 39929
-------------------------------
Triton-ICS-Attack-Port-UDP-39929 exists - ok
Linux Perspective:
iptables -I INPUT 1 -p UDP -m multiport -d 192.168.0.0/16 -s 0.0.0.0/0 --dport 39929 --sport 1502 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j DROP
or
ufw deny in proto udp from 0.0.0.0/0 port 1502 to 192.168.0.0/16 port 39929 comment "Triton Attack UDP 1502 and 39929" (this is an ex., the default network could on the 172.16 or 10. Network)
Todd