www.cisa.gov
Open in
urlscan Pro
23.67.131.29
Public Scan
URL:
https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-01
Submission: On December 17 via api from UA — Scanned from PL
Submission: On December 17 via api from UA — Scanned from PL
Form analysis 2 forms found in the DOM
<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id1">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form><form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id2">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form>Text Content
Skip to main content
An official website of the United States government
Here’s how you know
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.
Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue
Search
×
search
Menu
Close
×
search
* Topics
Topics
Cybersecurity Best Practices
Cyber Threats and Advisories
Critical Infrastructure Security and Resilience
Election Security
Emergency Communications
Industrial Control Systems
Information and Communications Technology Supply Chain Security
Partnerships and Collaboration
Physical Security
Risk Management
How can we help?
GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
LocallyFaith-Based CommunityExecutivesHigh-Risk Communities
* Spotlight
* Resources & Tools
Resources & Tools
All Resources & Tools
Services
Programs
Resources
Training
Groups
* News & Events
News & Events
News
Events
Cybersecurity Alerts & Advisories
Directives
Request a CISA Speaker
Congressional Testimony
CISA Conferences
CISA Live!
* Careers
Careers
Benefits & Perks
HireVue Applicant Reasonable Accommodations Process
Hiring
Resume & Application Tips
Students & Recent Graduates
Veteran and Military Spouses
Work @ CISA
* About
About
Culture
Divisions & Offices
Regions
Leadership
Doing Business with CISA
Site Links
Reporting Employee and Contractor Misconduct
CISA GitHub
CISA Central
2024 Year In Review
Contact Us
Subscribe
Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue
Breadcrumb
1. Home
2. News & Events
3. Cybersecurity Advisories
4. ICS Advisory
Share:
ICS Advisory
THREATQUOTIENT THREATQ PLATFORM
Release Date
December 17, 2024
Alert Code
ICSA-24-352-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF(link is external)
1. EXECUTIVE SUMMARY
* CVSS v4 8.7
* ATTENTION: Exploitable remotely/low attack complexity
* Vendor: ThreatQuotient Inc.
* Equipment: ThreatQ Platform
* Vulnerability: Command Injection
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to perform
remote code execution.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of ThreatQuotient ThreatQ Platform, are affected:
* ThreatQ Platform: Versions prior to 5.29.3
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND ('COMMAND
INJECTION') CWE-77(LINK IS EXTERNAL)
In ThreatQuotient ThreatQ Platform versions prior to 5.29.3, a command injection
vulnerability exists within the api endpoint that could allow an attacker to
perform remote code execution.
CVE-2024-39703(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 8.8 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H(link is external)).
A CVSS v4 score has also been calculated for CVE-2024-39703(link is external). A
base score of 8.7 has been calculated; the CVSS vector string is
(CVSS4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N(link is
external)).
3.3 BACKGROUND
* CRITICAL INFRASTRUCTURE SECTORS: Information Technology
* COUNTRIES/AREAS DEPLOYED: Worldwide
* COMPANY HEADQUARTERS LOCATION: United States
3.4 RESEARCHER
Dawid Golak reported this vulnerability to CISA.
4. MITIGATIONS
ThreatQuotient has released the following for users to implement:
* ThreatQ Platform: Version 5.29.3
CISA recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability, such as:
* Minimize network exposure for all control system devices and/or systems,
ensuring they are not accessible from the internet.
* Locate control system networks and remote devices behind firewalls and
isolating them from business networks.
* When remote access is required, use more secure methods, such as Virtual
Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should
be updated to the most current version available. Also recognize VPN is only
as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber
defense best practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.
Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.
CISA also recommends users take the following measures to protect themselves
from social engineering attacks:
* Do not click web links or open attachments in unsolicited email messages.
* Refer to Recognizing and Avoiding Email Scams for more information on
avoiding email scams.
* Refer to Avoiding Social Engineering and Phishing Attacks for more
information on social engineering attacks.
No known public exploitation specifically targeting this vulnerability has been
reported to CISA at this time.
5. UPDATE HISTORY
* December 17, 2024: Initial Publication
This product is provided subject to this Notification and this Privacy &
Use policy.
TAGS
Sector: Information Technology Sector
Topics: Industrial Control System Vulnerabilities, Industrial Control Systems
PLEASE SHARE YOUR THOUGHTS
We recently updated our anonymous product survey; we’d welcome your feedback.
RELATED ADVISORIES
Dec 17, 2024
ICS Advisory | ICSA-24-352-04
SCHNEIDER ELECTRIC MODICON
Dec 17, 2024
ICS Advisory | ICSA-24-352-02
HITACHI ENERGY TROPOS DEVICES SERIES 1400/2400/6400
Dec 17, 2024
ICS Advisory | ICSA-24-352-03
ROCKWELL AUTOMATION POWERMONITOR 1000 REMOTE
Dec 12, 2024
ICS Advisory | ICSA-24-347-02
SIEMENS ENGINEERING PLATFORMS
Return to top
* Topics
* Spotlight
* Resources & Tools
* News & Events
* Careers
* About
Cybersecurity & Infrastructure Security Agency
* Facebook
* Twitter
* LinkedIn
* YouTube
* Instagram
* RSS
CISA Central 1-844-Say-CISA SayCISA@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
* About CISA
* Budget and Performance
* DHS.gov
* Equal Opportunity & Accessibility
* FOIA Requests
* No FEAR Act
* Office of Inspector General
* Privacy Policy
* Subscribe
* The White House
* USA.gov
* Website Feedback