3 Advisories and 2 Updates Published – 12-12-19

Today the CISA NCCIC-ICS published three control system security advisories for products from Omron (2) and Advantech. They also updated a medical device advisory for products from Philips and a multi-vendor advisory.

Omron Advisory #1

This advisory describes and improper restriction of excessive authentication attempts vulnerability in the Omron CJ, CS and NJ Series PLCs. The vulnerability was reported by n0b0dy. Omron provides generic workarounds to mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to brute force login credentials, obtain unauthorized access of the system, and may allow an attacker unauthorized access to the FTP interface.

Omron Advisory #2

This advisory describes three vulnerabilities in the Omron CJ and CS Series PLCs. The vulnerabilities were reported by Wang Zhibei and n0b0dy. Omron provides generic workarounds to mitigate the vulnerabilities.

The three reported vulnerabilities are:

• Authentication bypass by spoofing - CVE-2019-18259;

• Authentication bypass by capture/replay - CVE-2019-13533; and

• Unrestricted externally accessible lock - CVE-2019-18269

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to pose as an authorized user to obtain the status information of the PLC.

Advantech Advisory

This advisory describes a stack-based buffer overflow vulnerability in the Advantech DiagAnywhere Server. The vulnerability was reported by Z0mb1E via the Zero Day Initiative. The device is no longer supported.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to may allow remote code execution.

Philips Update

This update provides additional information on an advisory that was originally published on November 14^th, 2019. The new information is an additional generic workaround to mitigate the vulnerability.

PLC Cycle Time Influences Update

This update provides additional information on an advisory that was originally published on April 16^th, 2019. The new information is the addition of another affected product from Phoenix Contact.

Interesting Twitter Thread

An interesting Twitter® thread today about record number of vulnerabilities in a single advisory. Spoiler alert: Siemens is not the record holder.