Last Friday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published an advisory on a memory corruption vulnerability in the 7-Technologies IGSS human machine interface (HMI) application.
The vulnerability in the Open Database Connectivity (OBDC) component could allow an attacker with advanced skills to remotely execute arbitrary code. There is no known publicly available exploit for this vulnerability. 7-Technologies has published a patch, but recommends upgrading to a more recent version that does not contain the vulnerability. Hmmm… did they know about the vulnerability and remove it in the newer version or was the removal as unintentional as the original insertion?
The interesting thing about this reported vulnerability is that it is an indication that security researchers are digging deeper into these systems to find newer types of vulnerabilities. Of course, finding this vulnerability in the IGSS HMI will ensure that other researchers look for the same type vulnerability in other SCADA HMI applications.
Subscribe to:
Post Comments (Atom)
Posts
No comments:
Post a Comment