Customer Letter dcom

Dear costumer,

Microsoft has announced and released changes to the Windows operating system due to a serious vulnerability: CVE-2021-26414. These changes, if installed, will affect Waterfall’s OPC DA, OPC A&E and OPC HDA connectors. Following the Microsoft announcement regarding the vulnerability fix, Waterfall Security took proactive action to notify our customers about any implications that might follow from Microsoft’s change.

For more information regarding CVE-2021-26414 Please refer to the link below from Microsoft official site:
https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

 Effected environments:

Only customers with OPC DA, OPC A&E, and OPC HDA systems are directly affected. There is NO direct or indirect effect to any other connectors, solutions or configuration which were provided by Waterfall Security at any release.

Waterfall recommendations:

  1. Waterfall will release an official product version by the end of Q4 2022 (V7 GA7) which will support the Microsoft DCOM critical update.
  2. Customers who have install Waterfall’s V7 GA5 and earlier, are recommended to plan upgrading their systems to Windows Server 2016 or later as well as Waterfall’s software version V7 GA7 or later, to keep their systems at the highest security level.
  3. Customers who decide not to apply Microsoft patch (KB5004442), will be able to continue working with past and future Waterfall’s releases.
  4. Customers that already applied the Microsoft patch, or planning to apply it prior to V7 GA7 release, will be able to continue working with any available Waterfall versions UNTIL MARCH 14, 2023, (refers to “Registry setting to enable or disable the hardening changes” at Microsoft CVE-2021-26414 announcement).
    Note that none of these vulnerabilities or changes affect Waterfall’s Unidirectional Gateway hardware functions – with or without any of these changes, the unidirectional hardware is physically able to send information in only one direction.

 

Waterfall support will be happy to assist with any question or inquiry through all its channels
https://waterfall-security.com/legal/customer-support