2 Advisories Published – 11-24-20

Today the CISA NCCIC-ICS published two control system security advisories for products from Fuji Electric and Rockwell Automation.

Fuji Advisory

This advisory describes an out-of-bounds write vulnerability in the Fuji V-Server Lite. The vulnerability was reported by Tran Van Khang - khangkito of VinCSS via the Zero Day Initiative. Fuji has a new version that mitigates the vulnerability. There is no indication that Khang has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an relatively low-skilled attacker with uncharacterized access could exploit this vulnerability to allow for remote code execution on the device.

Rockwell Advisory

This advisory describes three vulnerabilities in the Rockwell FactoryTalk Linx. The vulnerabilities were reported by Sharon Brizinov of Claroty. Rockwell has new versions that mitigate the vulnerability. There is no indication that Brizinov has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper input validation - CVE-2020-27253, and

• Heap-based buffer overflow (2) - CVE-2020-27251 and CVE-2020-27255

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow a denial-of-service condition, remote code execution, or leak information that could be used to bypass address space layout randomization (ASLR).