VulnHub

The FBI has issued a warning about scammers posing as agents who are exploiting victims of previous fraud. These fake agents are using deepfake videos and spoofed websites that mimic the Internet Crime Complaint Center (IC3) to convince individuals that they can recover lost funds. Victims are lured into providing personal information and money under false promises of assistance. This scam particularly targets those who have already experienced fraud, making them more vulnerable to these deceptive claims. It's crucial for anyone who has been a victim of scams to be cautious and verify the legitimacy of anyone claiming to be from law enforcement.

Rockwell Automation has identified a vulnerability in its 1734 POINT I/O module that could lead to a denial-of-service condition. Specifically, attackers can exploit this issue by sending specially crafted CIP messages, causing the module to fail and requiring a restart for recovery. The affected version is 3.023 of the 1734 POINT I/O module, which is used in critical manufacturing sectors worldwide. While there are no reports of active exploitation at this time, organizations using this equipment are urged to take precautions. Rockwell recommends migrating to a newer version, specifically 5034-OB8, or following their security best practices to mitigate risks.

The FBI has issued a warning about deepfake videos that impersonate leaders from the Internet Crime Complaint Center (IC3). These videos are misleading users into visiting fake complaint sites, where they may unknowingly provide personal information or report fraudulent activities. This tactic is particularly concerning as it uses the authority of recognized figures to lend credibility to the scam. The deepfake technology can make these videos appear highly convincing, making it difficult for individuals to discern the truth. As a result, users should be cautious and verify any communications they receive that claim to be from IC3 or similar agencies.

Tycon Systems' TPDIN-Monitor-WEB2 has critical vulnerabilities that could allow attackers to bypass authentication and access sensitive controls of connected infrastructure. Specifically, the version 2.3.9 is affected by an authentication bypass flaw that enables unauthorized users to gain full administrative access by submitting empty login credentials. Additionally, another flaw reveals system credentials in cleartext, which could facilitate further network compromises. Users of this device are advised to contact Tycon Systems for updates and to ensure their systems are secure. These vulnerabilities pose serious risks, not only to data security but also to physical safety, as attackers could manipulate equipment remotely.

Siemens has identified multiple vulnerabilities in its SIDIS Secured SmartPlug, particularly affecting versions prior to 7.26.0310. The vulnerabilities stem from components like OpenSSL and OpenSSH, leading to severe security risks including improper message integrity enforcement and various buffer overflow issues. These flaws could allow attackers to exploit the system for arbitrary code execution or denial of service. Siemens strongly recommends updating to the latest version to mitigate these risks. This situation is critical, especially for users in critical manufacturing sectors globally, as it exposes them to potential exploitation by malicious actors.

The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities Catalog by adding four vulnerabilities that are currently being exploited. The vulnerabilities include a stack-based buffer overflow in DD-WRT (CVE-2021-27137), a conflict in WordPress core that allows for SQL injection (CVE-2026-60137), and others affecting Langflow and WordPress core functionality. These vulnerabilities pose significant risks, especially to federal agencies, as they can lead to unauthorized control over systems. CISA's guidance emphasizes the need for swift action to remediate these vulnerabilities, encouraging all organizations to prioritize their management. Anyone aware of additional exploited vulnerabilities can submit them for consideration to be added to the catalog.

Siemens has reported a vulnerability in multiple versions of its IAM Client software, which could allow an authenticated local attacker to escalate their privileges. This unquoted search path vulnerability affects various Siemens products, including COMOS, Designcenter NX, and several Simcenter and Solid Edge applications. Siemens has rolled out updates for several affected versions and advises users to upgrade to the latest releases to mitigate the risk. For products that do not currently have fixes available, Siemens is recommending additional countermeasures. Organizations using these products should take immediate action to ensure their systems are secure, as this issue could potentially expose sensitive environments in critical industries such as manufacturing and energy.

Palo Alto Networks has issued an advisory regarding vulnerabilities in its PAN-OS software that affect the Siemens RUGGEDCOM APE1808, utilized in critical manufacturing sectors globally. The vulnerabilities include cross-site scripting, privilege escalation, and command injection, which could allow authenticated users to execute arbitrary commands or store malicious scripts. Users of the RUGGEDCOM APE1808 need to be particularly cautious, as these security flaws could lead to unauthorized access and potential exploitation of the device. Siemens recommends that affected customers consult with their support teams to obtain patches and implement security measures to protect their systems.

Rockwell Automation has reported a vulnerability affecting their 1718-AENTR and 1719-AENTR products, specifically version 3.011 of the Ex I/O series. This flaw can lead to a denial-of-service condition, where the device becomes overloaded due to improper handling of a UDP unicast network storm, resulting in loss of communication. Recovery from this issue requires a power cycle. Users worldwide are advised to upgrade to version 3.012 or later to mitigate this risk. For those unable to upgrade, Rockwell Automation recommends following their security best practices to minimize exposure. This vulnerability is significant as it impacts devices used in critical manufacturing sectors, raising concerns about operational stability and security.

Siemens has identified multiple vulnerabilities affecting its CADRA software, primarily linked to zlib and Foxit libraries. These vulnerabilities include issues like improper input validation and buffer overflows, which could allow attackers to disrupt service or exploit systems. Siemens is urging users to update to CADRA version V2511 or later to mitigate these risks. For systems that cannot be immediately updated, the company recommends specific countermeasures to reduce exposure until fixes are available. This situation is particularly critical for sectors such as chemical and energy, where security vulnerabilities can have serious implications.

Rockwell Automation has disclosed a significant vulnerability in its FactoryTalk Services Platform (FTSP) version 6.60, which could allow attackers to impersonate authorized users. This flaw arises from weak authentication practices, specifically the inability of the application to properly validate JSON Web Tokens (JWT). As a result, low-privilege users could exploit this vulnerability to gain unauthorized access to critical system configurations and permissions. Organizations using FTSP are urged to apply a specific patch (RAID 1158263) or the February 2026 Patch Roll-up to mitigate this risk. As of now, there have been no reports of active exploitation in the wild, but users are advised to follow best security practices to protect their systems.

Siemens has identified a significant security vulnerability in its Opcenter X software, specifically in versions prior to V2604. This flaw allows attackers to bypass authentication, enabling unauthorized access to the application and the ability to impersonate any user, including administrators. The vulnerability stems from improper validation of the algorithm in the JSON Web Token (JWT) header, which could lead to severe security breaches. Siemens has urged all users to upgrade to version V2604 or later to mitigate this risk. This incident is particularly alarming as it affects critical manufacturing infrastructures worldwide, emphasizing the need for timely software updates and robust cybersecurity practices.

The article discusses the challenges of patching software vulnerabilities in a timely manner. When vendors release a security patch, they reveal information about what was fixed, which can be exploited by attackers against systems that haven't been updated yet. This practice, known as N-day exploitation, creates a race between the vendors issuing patches and defenders trying to apply these updates before they are targeted. The piece emphasizes that simply patching faster may not be enough to protect systems, as the window of opportunity for attackers can be dangerously short. This issue affects all companies relying on software, particularly those with critical infrastructure that may be slow to implement updates.