3 Advisories Published – 03-26-19

Today the DHS NCCIC-ICS published three control system security advisories for products from ENTTEC, Phoenix Contact and Siemens.

ENTTEC Advisory

This advisory describes a missing authentication for critical function vulnerability in the ENTTEC Datagate MK2, Storm 24, Pixelator industrial lighting control products. The vulnerability was reported by Ankit Anubhav of NewSky Security. ENTTEC has updated firmware that mitigate the vulnerability. There is no indication that Anubhav has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to reboot this device allowing a continual denial of service condition.

Phoenix Contact Advisory

This advisory describes a command injection vulnerability in the Phoenix Contact RAD-80211-XD radio modules. The vulnerability was reported by Maxim Rupp. The affected products are no longer supported.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to  allow an attacker to execute system level commands with administrative privileges.

Siemens Advisory

This advisory describes an expected behavior violation vulnerability in the Siemens SCALANCE X switches. The vulnerability is being self-reported. Siemens has a new version that mitigates the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow an attacker to feed data over a mirror port and into the mirrored network.

NOTE: I briefly reported on this vulnerability earlier this month.