Cyber

What changed

An OS command injection vulnerability has been discovered in the firmware of FXC AE1021 and AE1021PE devices. This vulnerability allows an attacker with login access to execute arbitrary OS commands, potentially compromising the integrity and security of the affected systems.

• The vulnerability is present in AE1021PE firmware version 2.0.9 and earlier.
• The vulnerability is also found in AE1021 firmware version 2.0.9 and earlier.
• Successful exploitation could lead to unauthorized access and control over the affected devices.

Who is affected

Organizations utilizing FXC AE1021 and AE1021PE products should be aware of their exposure to this vulnerability. It is crucial to assess the impact on their operational environment.

• Users of FXC AE1021 firmware version 2.0.9 and earlier.
• Users of FXC AE1021PE firmware version 2.0.9 and earlier.
• Organizations relying on these devices for critical operations.

What to do

To mitigate the risks associated with this vulnerability, affected users should take immediate action to secure their systems. Upgrading to the latest firmware version is essential.

• Upgrade to the latest firmware version provided by FXC to eliminate the vulnerability.
• Restrict access to the devices to authorized personnel only.
• Monitor system logs for any unauthorized access attempts.

What changed

Unitronics has reported a significant security vulnerability affecting its Vision PLC and HMI products. The issue arises from the use of an insecure default administrative password in VisiLogic versions prior to 9.9.00.

This vulnerability enables unauthenticated attackers with network access to gain administrative control over affected systems, posing a serious risk to operational integrity.

Who is affected

Organizations utilizing Unitronics Vision PLCs and HMIs, particularly those running VisiLogic versions earlier than 9.9.00, are at risk.

This includes manufacturing facilities, automation systems, and any infrastructure relying on these devices for operational control.

• Unitronics Vision PLCs
• Unitronics Vision HMIs
• Manufacturing and automation sectors
• Organizations using VisiLogic software

What to do

It is imperative for affected organizations to update their VisiLogic software to version 9.9.00 or later to mitigate this vulnerability.

Additionally, organizations should review their security policies regarding default passwords and implement measures to enforce strong password practices.

• Upgrade VisiLogic to version 9.9.00 or higher.
• Change default passwords immediately on all devices.
• Implement network segmentation to limit access to PLCs and HMIs.
• Regularly audit and monitor access to critical systems.