Infrastructure operations are in the crosshairs again. This time, cybersecurity researchers from JFrog and Forescout discovered and disclosed that there are no less than 14 vulnerabilities in the TCP/IP stack that is used in millions of devices within the operations areas of organizations such as power generation and critical infrastructure. More than 200 vendors are involved and the products are used in the various areas.
Specifically targeted is NicheStack. The collection of issues is being referred to as “INFRA:HALT.” If accessed, a plethora of attacks could be executed such as denial of service (DOS), TCP spoofing, remote code execution, and DNS cache poisoning, to name a few.
Manufacturers of the various products is quite the all-star lineup and includes:
- Siemens
- Honeywell
- Rockwell Automation
- Emerson
- Schneider Electric
Others are likely also affected, but good news is that patches have been released. The bad news is that it might take quite some time for everyone using the affected products to get the patches applied. That said, as soon as is reasonably possible, those who manage these should get them done. If you’re unsure, Forescout released open-source script to help those find which devices may need to be addressed.
The list of flaws is extensive and includes the following:
- CVE-2020-25926
- CVE-2020-25927
- CVE-2020-25928
- CVE-2020-25767
- CVE-2020-35683
- CVE-2020-35684
- CVE-2020-35685
- CVE-2021-27565
- CVE-2021-31226
- CVE-2021-31227
- CVE-2021-31228
- CVE-2021-31400
- CVE-2021-31401
- CVE-2021-36762
According to reports, the largest sector affected by this is Energy & Power Industrial Control Systems at 46%. It’s followed by VOIP (25%), Networking (18%), Other (6%), Computer (4%), and Multimedia & Entertainment (1%).
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
