Kevin Durant and Stephen Curry can’t escape the fact that the Celtics are NBA champions with three C’s players on the Team USA roster at the Olympics.
July 2024
Fantasy Baseball Weekend Preview: Tyler Fitzgerald looks to stay hot heading into Week 17
If you need streaming options this weekend, you’re in luck. Analyst Fred Zinkie highlights matchups to target and worthy streamers in this weekend’s fantasy baseball preview.
Formula 1: Esteban Ocon to drive for Haas in 2025
Ocon will be teammates with Ferrari junior driver Ollie Bearman.
Why the Knicks were right to extend head coach Tom Thibodeau
The Knicks continued their headline-making offseason Wednesday afternoon, signing head coach Tom Thibodeau to a three-year extension.
Paris 2024: NBA starpower still hasn’t faded at Olympics
Stephen Curry and Kevin Durant drew a massive press gathering in Paris ahead of Team USA’s Olympic opener Sunday against Serbia.
Paris 2024: NBA starpower still hasn’t faded at Olympics
Stephen Curry and Kevin Durant drew a massive press gathering in Paris ahead of Team USA’s Olympic opener Sunday against Serbia.
USDA Announces the 2024 Class of USDA 1890 National Scholars
WASHINGTON, July 25, 2024 – Today, the U.S. Department of Agriculture (USDA) announces 91 scholarships awarded through the USDA 1890 National Scholars Program, one of the Department’s efforts to develop the next generation of diverse food and agriculture professionals. The USDA 1890 National Scholars Program is a partnership between USDA and the 19 historically Black land-grant universities that were established under the Second Morrill Act of 1890 and is administered by USDA’s Office of Partnerships and Public Engagement (OPPE).
Positron Broadcast Signal Processor
1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Positron S.R.L
- Equipment: Broadcast Signal Processor TRA7005
- Vulnerability: Authentication Bypass Using an Alternate Path or Channel
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to bypass authentication and access unauthorized protected areas of the application.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Positron Broadcast Signal Processor are affected:
- Broadcast Signal Processor TRA7005: v1.20
3.2 Vulnerability Overview
3.2.1 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to protected areas of the application.
CVE-2024-7007 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2024-7007. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Communications
- COUNTRIES/AREAS DEPLOYED: Italy
- COMPANY HEADQUARTERS LOCATION: Italy
3.4 RESEARCHER
CISA discovered a public proof of concept (PoC) as authored by Gjoko Krstic and reported it to Positron.
4. MITIGATIONS
Positron has not responded to requests to work with CISA to mitigate this vulnerability. Users of affected versions of TRA7005 are invited to contact Positron customer support for additional information.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:
- Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
- Locate control system networks and remote devices behind firewalls and isolating them from business networks.
- When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
5. UPDATE HISTORY
- July 25, 2024: Initial Publication
FBI, CISA, and Partners Release Advisory Highlighting North Korean Cyber Espionage Activity
Today, CISA—in partnership with the Federal Bureau of Investigation (FBI)—released a joint Cybersecurity Advisory, North Korea State-Sponsored Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs. The advisory was coauthored with the following organizations:
- U.S. Cyber National Mission Force (CNMF);
- U.S. Department of Defense Cyber Crime Center (DC3);
- U.S. National Security Agency (NSA);
- Republic of Korea’s National Intelligence Service (NIS);
- Republic of Korea’s National Police Agency (NPA); and
- United Kingdom’s National Cyber Security Centre (NCSC).
This advisory was crafted to highlight cyber espionage activity associated with the Democratic People’s Republic of Korea (DPRK)’s Reconnaissance General Bureau (RGB) 3rd Bureau based in Pyongyang and Sinuiju. The group primarily targets defense, aerospace, nuclear, and engineering entities to obtain sensitive and classified technical information and intellectual property to advance the regime’s military and nuclear programs and ambitions.
The authoring agencies believe the group and the cyber techniques remain an ongoing threat to various industry sectors worldwide, including but not limited to entities in their respective countries, as well as in Japan and India.
All critical infrastructure organizations are encouraged to review the advisory and implement the recommended mitigations. For more information on North Korean state-sponsored threat actor activity, see CISA’s North Korea Cyber Threat Overview and Advisories page.
Andariel actors fund their espionage activity through ransomware operations against U.S. healthcare entities. For more information on this ransomware activity, see joint advisories #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities and North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector.
Siemens SICAM Products
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v4 9.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: CPCI85 for CP-8031/CP-8050, CPCI85, SICORE
- Vulnerabilities: Unverified Password Change, Missing Authentication for Critical Function
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to perform an unauthorized password reset which could lead to privilege escalation and potential leak of information.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Siemens SICAM product versions are affected:
- CPCI85 Central Processing/Communication: All versions prior to V5.40
- SICORE Base system: All versions prior to V1.4.0
3.2 Vulnerability Overview
3.2.1 UNVERIFIED PASSWORD CHANGE CWE-620
The password of administrative accounts of the affected applications can be reset without requiring the knowledge of the current password, given the auto login is enabled. This could allow an unauthorized attacker to obtain administrative access of the affected applications.
CVE-2024-37998 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2024-37998. A base score of 9.3 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.2.2 MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected devices allow a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities.
CVE-2024-39601 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2024-39601. A base score of 7.1 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER
Jan Kaestle from Siemens Energy reported the vulnerability CVE-2024-37998 to Siemens. Steffen Robertz, Gerhard Hechenberger, Stefan Viehböck, and Constantin Schieber-Knöbl from SEC Consult Vulnerability Lab reported the vulnerability CVE-2024-39601 to Siemens.
4. MITIGATIONS
Siemens recommends users to update to the latest version:
- CPCI85 Central Processing/Communication: Update to V5.40 or later
- SICORE Base system: Update to V1.4.0 or later
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:
- CVE-2024-37998: Disable the auto login feature
Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage
For more information see the associated Siemens security advisory SSA-071402 in HTML and CSAF.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
- Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
- Locate control system networks and remote devices behind firewalls and isolating them from business networks.
- When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
5. UPDATE HISTORY
- July 25, 2024: Initial Publication