ICS-CERT Publish an Alert and an Advisory

Yesterday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published an advisory and an alert on multiple control system related programs. The advisory was for stack overflow vulnerability reported in ICONICS GENESIS32 and BisVis. The alert concerns reported buffer overflow vulnerabilities in Advantech Studio and Advantech ISSSymbol.

ICONICS Advisory

A security researcher has reported a stack overflow vulnerability in a common component (WebHMI) of ICONICS GENESIS32 and BisVis that could allow a moderately skilled remote attacker to run arbitrary code on either system. ICS-CERT reports that a social engineering attack would need to be conducted before the publicly available exploit could be successfully used.

The advisory notes that ICONICS has a patch (WebHMI V9.21Patch) available for both systems and has plans to address the vulnerability in upcoming versions of both programs. They have also updated their security whitepaper with details about this vulnerability.

Advantech Alert

ICS-CERT reports that they have become aware of reports about ‘multiple buffer overflow’ vulnerabilities in Advantech ISSSymbol and Advantech Studio which may allow execution of arbitrary code. ICS-CERT is working with Advantech to confirm and potentially mitigate the reported vulnerabilities.