ArcaneDoor cyberespionage campaign exploited Cisco zero-days.

Korenix JetlO 6550 Vulnerability Lets Attackers Gain Unauthorized Access

[[{“value”:”

Researchers at Hadess have identified a critical vulnerability in the widely-used Korenix JetlO industrial Ethernet switch series.

The flaw tracked as CVE-2024-2371 could allow attackers to gain unauthorized access to sensitive data within critical infrastructure and industrial control systems (ICS).

The vulnerability is rooted in the handling of the Simple Network Management Protocol (SNMP) by the Korenix JetlO switches. Due to insufficient access controls within the SNMP implementation, attackers can exploit this flaw to read sensitive information, such as configuration details and network topology, which are crucial for maintaining the security and integrity of industrial systems.

By sending specially crafted SNMP requests, malicious actors can bypass existing authentication mechanisms, gaining unauthorized access to critical system parameters.

This security gap presents a significant threat, as unauthorized access to these details could lead to operational disruptions, manipulation of system settings, network communication breakdowns, and even equipment malfunctions.

Document

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

:

The problem of vulnerability fatigue today
Difference between CVSS-specific vulnerability vs risk-based vulnerability
Evaluating vulnerabilities based on the business impact/risk
Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, that helps you to quantify risk accurately:

Book Your spot

Exploiting CVE-2024-2371

Exploiting CVE-2024-2371 has far-reaching potential impacts. In industrial environments where uptime is critical, such disruptions can result in production losses, safety hazards, and severe environmental damage, according to the Hadess report.

The vulnerability underscores the increasing need for robust cybersecurity measures in the industrial sector, where the convergence of IT and operational technology (OT) systems has exposed critical infrastructure to new risks.

In response to the discovery of CVE-2024-2371, Korenix, and other vendors must promptly release patches or firmware updates to address the vulnerability. Meanwhile, affected system operators must take proactive steps to secure their networks.

This includes implementing stringent access controls, segmenting networks to limit the spread of potential intrusions, and deploying intrusion detection systems to monitor for suspicious activities.

The cybersecurity community is closely monitoring the situation, as the exploitation of such vulnerabilities can have cascading effects on interconnected systems and services.

Organizations using Korenix JetlO switches are advised to review their security protocols, apply necessary updates, and remain vigilant against possible exploitation attempts.

As the digital transformation of industrial systems continues, the discovery of CVE-2024-2371 serves as a stark reminder of the importance of cybersecurity diligence.

Stakeholders across the industry must collaborate to fortify defenses against an ever-evolving threat landscape and ensure the resilience of critical infrastructure worldwide.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

The post Korenix JetlO 6550 Vulnerability Lets Attackers Gain Unauthorized Access appeared first on Cyber Security News.

“}]]   Read More 

Cyber Security News 

FBI warns cryptocurrency app beta-testers of malware menace

Are you the kind of person who runs the beta-test versions of mobile apps before they are officially released? If so, the FBI is warning you to be on your guard.

Read more in my article on the Hot for Security blog.   Read More 

Graham Cluley