The US Cybersecurity and Infrastructure Security Agency (CISA) published seven advisories this week covering vulnerabilities in industrial control systems (ICS) and supervisory control and data acquisition (SCADA) software from multiple vendors. Some of the flaws are rated critical and two of them already have public exploits.
The impacted products include:
Scadaflex II controllers made by Industrial Control Links
Screen Creator Advance 2 and Kostac PLC programming software from JTEKT Electronics
Korenix JetWave industrial wireless access points and communications gateways
Hitachi Energy’s MicroSCADA System Data Manager SDM600
mySCADA myPRO software
Rockwell Automation’s FactoryTalk Diagnostics
ScadaFlex II series controllers are what’s known in the industry as packaged controllers, stand-alone systems that are built with custom software, processing power and I/O capabilities for controlling and monitoring other industrial processes. According to CISA, multiple versions of the software running on the SC-1 and SC-2 controllers are impacted by a critical vulnerability — CVE-2022-25359 with CVSS score 9.1 — that could allow unauthenticated attackers to overwrite, delete, or create files on the system.