ICS-CERT BroadWin Vulnerability Update

Yesterday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published an advisory that provided updated information for their alert published last month for the Advantech/BroadWin WebAccess HMI product. This was the alert where Ruben Santamarta, the security researcher who discovered the vulnerability, tried to coordinate the public notification of the vulnerability with the vendor, but went public on his own when he was rebuffed by the vendor. The vendor has since validated the vulnerability to ICS-CERT and is working with that agency to produce an appropriate patch.

This advisory notes that the vulnerability is a Remote Procedure Call (RPC) vulnerability that would allow a moderately skilled attacker to use the publicly available exploit to remotely execute arbitrary code. While the patch is being developed, ICS-CERT recommends that users should follow the security recommendations in the BroadWin installation manual.