ICS/OT CYBERSECURITY
hub.dragos.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
7 CVEs- CVE-2021-44228Apache Log4j2 Remote Code Execution VulnerabilityApache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports>99.9%Top 0.01%90.0priority
- CVE-2021-34527Microsoft Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1068Exploitation for Privilege Escalation4 reports99.8%Top 0.04%88.1priority
- CVE-2021-1675Microsoft Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1059Command and Scripting Interpreter3 reports85.3%Top 0.28%86.1priority
- CVE-2021-34481Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1507Public exploitHigh · 8.81 report47.7%Top 1.2%81.6priority
- CVE-2018-8872In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from…Schneider Electric · Triconex Tricon1 report2.2%Top 17%55.4priority
- CVE-2021-36958Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1507High · 7.81 report30.8%Top 1.8%29.7priority
- CVE-2020-15782A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open…Siemens · SIMATIC Drive Controller familyCritical · 9.81 report5.2%Top 7.5%29.2priority
Where it names them
CVE-2021-44228 Original (opens in a new tab) ↗
The Log4j vulnerability (CVE-2021- 44228) allows for remote code execution and access to servers and hardware that
CVE-2021-34527 Original (opens in a new tab) ↗
Adversaries can leverage PrintNightmare CVE-2021-34527, CVE-2021-34481, and
CVE-2021-1675 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
to confusion over another Print Spooler vulnerability (CVE-2021-1675, released on June
was the same method to exploit Windows Print Spooler CVE-2021-1675 and thus was
Because CVE-2021-1675 had already been patched, they saw no
CVE-2021-34481 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Adversaries can leverage PrintNightmare CVE-2021-34527, CVE-2021-34481, and
Spooler Service (CVE-2021-34481) that could also allow an adversary to perform remote
CVE-2018-8872 Original (opens in a new tab) ↗
demonstrated use of a ladder logic payload for developing a rootkit in Phoenix Contact’s logic runtime, which is used by dozens of PLC vendors.16 Earlier research covered rootkits in another ladder logic runtime by 3S-Software.17 Triconex SIS was the victim of such an attack, which used CVE-2018-8872 and
CVE-2021-36958 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2021-36958 vulnerabilities to gain access to OT networks from IT networks
A fourth vulnerability (CVE-2021-36958)
CVE-2020-15782 Original (opens in a new tab) ↗
In 2021, Siemens disclosed a vulnerability in its PLC, CVE-2020-15782,15 which can
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.