CISA Releases Four Industrial Control Systems Advisories

Summary:

On September 19, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) released four Industrial Control Systems (ICS) advisories to inform stakeholders about current security issues, vulnerabilities, and exploits affecting ICS. These advisories provide valuable information for system administrators and users to address potential threats and ensure the secure operation of their industrial control systems.

ICSA-23-262-01: Siemens SIMATIC PCS neo Administration Console

The first advisory, ICSA-23-262-01, affects the Siemens SIMATIC PCS neo Administration Console, a part of Siemens’ SIMATIC PCS neo process control system. The advisory reports a vulnerability in the affected software, which could allow an attacker to remotely execute arbitrary code with elevated privileges. CISA recommends users and administrators upgrade to the latest version of the software, as well as implement additional security measures to mitigate the risk.

ICSA-23-262-03: Omron Engineering Software Zip-Slip

The second advisory, ICSA-23-262-03, is related to Omron Engineering Software and a vulnerability known as “Zip-Slip.”” This exploit could allow an attacker to inject malicious files into a Zip archive