Researchers found several potentially serious vulnerabilities in the PcVue SCADA/HMI solution developed by France-based ARC Informatique, including flaws that can allow an attacker to take control of industrial processes or cause disruption.
The PcVue product was analyzed by researchers from Kaspersky, who identified a total of three vulnerabilities. The vendor has patched the security holes with the release of version 12.0.17 and it has also shared some mitigations and workarounds to help customers prevent attacks.
Andrey Muravitsky, senior security researcher at Kaspersky and one of the people credited for finding the PcVue issues, told SecurityWeek that ARC Informatique “did an awesome job” and patched all vulnerabilities 5 months after being notified — it often takes industrial solutions providers much longer to fix vulnerabilities.
Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series
The most serious of the flaws, rated critical, is related to unsafe deserialization of messages received in the interface and it can lead to remote code execution. The other two vulnerabilities have been rated high severity — one can be leveraged for DoS attacks, while the other is an information disclosure issue that allows an attacker to access session data of legitimate users.
Kaspersky, which published advisories for these vulnerabilities in October, says ex ..
Support the originator by clicking the read the rest link below.
