Last week, Team82 published the inaugural installment of its new Biannual ICS Risk & Vulnerability Report, which offers an in-depth assessment of all ICS vulnerabilities disclosed during the first half of the year (1H 2020), the challenges they pose to security practitioners, and what conclusions can be drawn from publicly available data. For more insight into the report's research findings and the implications for those tasked with defending OT environments, join Claroty Chief Product Officer Grant Geyer for our upcoming webinar to be held this Thursday, Aug. 27, at 10 a.m. EST. Click here to register.
The infographics below offer some visual perspective into key statistics from the Claroty Biannual ICS Risk & Vulnerability Report, 1H 2020, which will be discussed in greater detail during the webinar:
The webinar will also offer additional insights into the vendors, products, sectors, and regions most affected by recently discovered ICS vulnerabilities, potential impacts and other characteristics of these vulnerabilities, and how the ICS risk & vulnerability landscape has changed since 1H 2019.
CWE-79 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING')
The affected product is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later.
CVSS v3: 9.8
CWE-787 OUT-OF-BOUNDS WRITE
The affected product is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later
CVSS v3: 7.6
CWE-78 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION')
An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later
CVSS v3: 9.8
CWE-78 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION')
An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later.
CVSS v3: 9.8
CWE-78 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION')
An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary commands.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later
CVSS v3: 9.8