This afternoon the DHS ICS-CERT published the first alert for a vulnerability reported at the Digital Bond SCADA Security Scientific Symposium (S4) conference; one that Dale hasn’t mentioned in his tweets yet (Hash Tag - #S4x2013). The alert covers multiple vulnerabilities reported by Arthur Gervais in the some products from Schneider Electric.
The four remotely executable vulnerabilities are listed below:
• BMX NOE 0110 – Unauthenticated SOAP/HTTP Interface – Remote code execution
• Modicon M340 – TCP connection resource exhaustion – Denial of Service
• Magelix XBT – HMI 6001/TCP hard coded credential – Loss of integrity
• Modicon M340 – Cross site request forgery – Unauthorized access