Review – 6 Advisories Published – 6-28-22

Today, CISA’s NCCIC-ICS published six control system security advisories for products from Motorola Solutions (3), Advantech, Omron, and ABB.

Motorola Advisory #1 - This advisory discusses the OT:ICEFALL vulnerabilities in the Motorola ACE1000. 

Motorola Advisory #2 - This advisory discusses the OT:ICEFALL vulnerabilities in the Motorola MDLC protocol parser.

Motorola Advisory #3 - This advisory discusses the OT:ICEFALL vulnerabilities in the Motorola MOSCAD IP Gateway and ACE IP Gateway.

Advantech Advisory - This advisory describes seven vulnerabilities in the Advantech iView management software.

Omron Advisory - This advisory discusses the OT:ICEFALL vulnerabilities in the Omron YSMAC CS/CJ/CP Series and NJ/NX Series PLCs.

ABB Advisory - This advisory describes two incorrect default permissions vulnerabilities in the ABB e-Design engineering software.

NOTE: I originally reported on these vulnerabilities on May 28^th. Interestingly, ZDI has not yet published DePlante’s advisories.

Commentary

It has been a week since NCCIC-ICS started their reporting on the OT:ICEFALL vulnerabilities. We still have not seen reports for the vulnerabilities in products from:

• Bentley Nevada (2),

• Emerson (21), and

• Honeywell (9)

In the last week many commentors in the OT space have noted that there is nothing really new here. In the broad scope, that is certainly true, most of the insecure by design problem was well understood when the Project Basecamp disclosures looked at the issues ten years ago. Given that, it is surprising that today is the first time that I have seen a specific recommendation by a vendor of an available upgrade to a more secure product.

 

For more details on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-published-6-28-22 - subscription required.