ICS Advisory: Socomec MOD3GP-SY-120K

Summary:

A vulnerability report has been issued for the Socomec MOD3GP-SY-120K device, which is classified as End-of-Life. The report mentions several vulnerabilities, including Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Insecure Storage of Sensitive Information, Code Injection, and Plaintext Storage of a Password. These vulnerabilities could allow an attacker to execute malicious code, obtain sensitive information, or steal session cookies. The mitigations recommended by Socomec include updating to MODULYS GP2 (M4-S-XXX), which is not affected by these vulnerabilities. CISA also recommends minimizing network exposure, using a VPN when remote access is required, and implementing recommended cybersecurity strategies.