ICS-CERT Publishes 5 Advisories

Yesterday the DHS ICS-CERT published four control system security advisories for products from ABB and Schneider (3). They also published on medical device security advisory for products from Qualcomm Life.

The ABB vulnerability was previously discussed here two weeks ago. Two of the Schneider vulnerabilities were discussed here last weekend.

ABB Advisory

This advisory describes an improper authentication vulnerability in the ABB eSOMS electronic shift operations management system. The vulnerability is self-reported (the ABB security advisory notes that they “received information about this vulnerability through responsible disclosure” but did not name the researcher). ABB will publish a new version on September 28^th that will mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit this vulnerability to gain access to the application without authentication.

Note: The ICS-CERT link to the ABB security advisory does not work, use the link above.

PowerLogic Advisory

This advisory describes a cross-site scripting vulnerability in the Schneider PowerLogic PM5560 power management system. The vulnerability was reported by Ezequiel Fernandez and Bertin Jose. Schneider has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow user input to be manipulated, allowing for remote code execution.

                                             

Modicon 221 Advisory (1)

This advisory describes an improper check for unusual or exceptional conditions vulnerability in the Schneider Modicon 221 PLCs. The vulnerability was reported by Yehonatan Kfir of Radiflow. A new firmware version mitigates the vulnerability. There is no indication that Kfir has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker could remotely exploit this vulnerability to remotely reboot the device.

Modicon 221 Advisory (2)

This advisory describes three vulnerabilities in the Schneider Modicon 221 PLCs. The vulnerabilities were reported by Irfan Ahmed, Hyunguk Yoo, Sushma Kalle, and Nehal Ameen of the University of New Orleans. A new firmware version mitigates the vulnerability. There is no indication that researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Information management errors - CVE-2018-7790; and

• Permissions, privileges and access controls (2) - CVE-2018-7791 and CVE-2018-7792

ICS-CERT reports that an uncharacterized attacker could remotely exploit the vulnerabilities to replay authentication sequences, overwrite passwords, or decode passwords.

Qualcomm Advisory

This advisory describes a code weakness vulnerability in the Qualcomm Life Capsule Datacaptor Terminal Server (DTS). The vulnerability was reported by Elad Luz of CyberMDX. A new firmware update mitigates the vulnerability in one of the affected products and work arounds have been identified for the remaining products. There is no indication that Luz has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability  to execute unauthorized code to obtain administrator-level privileges on the device.

Public ICS Disclosure – Week of 08-25-18

This week we have two vendor disclosures and three exploits for previously disclosed vulnerabilities; all for products from Schneider.

PowerLogic PM5560 Advisory

Schneider published an advisory for their PowerLogic PM5560 product for a cross protocol injection vulnerability. The vulnerability was reported by Ezequiel Fernandez and Bertin Jose. Schneider has an update available that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Modicon M221 Advisory

Schneider published an advisory for their Modicon M221 product for an improper check for unusual or exceptional conditions vulnerability. The vulnerability was reported by Yehonatan Kfir of Radiflow. Schneider has a firmware update available that mitigates the vulnerability. There is no indication that Kfir has been provided an opportunity to verify the efficacy of the fix.

Schneider Electric IGSS Exploit

Alejandro Parodi published exploit code for a remote code execution vulnerability in the Schneider Electric IGSS. This vulnerability was previously reported by ICS-CERT in January 2013.

Schneider Electric Serial Modbus Drive Exploits

Alejandro Parodi published exploit code (here and here) for two separate vulnerabilities in the Schneider Electric Serial Modbus Drive; a denial of service vulnerability and a remote code execution vulnerability. Both vulnerabilities were previously reported by ICS-CERT in March 2014.

ICS-CERT Publishes 5 Advisories

Yesterday the DHS ICS-CERT published five control system security advisories for products from ABB, Fuji Electric, Solar Controls (2), and SIMPlight.

ABB Advisory

This advisory describes a relative path traversal vulnerability in the ABB SREA-01 and SREA-50 remote monitoring tools. The vulnerability was reported by Bertin Jose and Fernandez Ezequiel. HMS Industrial Networks Ab provided a patch to correct the issue, but ABB has only tested it on the SREA-01. These are unsupported legacy products. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could use publicly available exploits to remotely exploit the vulnerability to access files on the affected products’ file systems, view data, change configuration, retrieve password hash codes, and potentially insert and send commands to connected devices without authorization.

NOTE: ABB reports that exploit code was published on github by the researchers.

Fuji Advisory

This advisory describes multiple vulnerabilities in the Fuji Monitouch V-SFT screen configuration software. The vulnerabilities were reported by Fritz Sands and kimiya via the Zero Day Initiative. Fuji has released a new version to mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2017-9659;

• Heap-based buffer overflow - CVE-2017-9660; and

• Improper privilege management - CVE-2017-9662

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to allow remote code execution or cause the software that the attacker is accessing to crash. The improper privilege management vulnerability could allow an attacker with local access to escalate privileges.

WATTConfig Advisory

This advisory describes an uncontrolled search path element vulnerability in the Solar Controls WATTConfig M Software. The vulnerability was reported by Karn Ganeshen. ICS-CERT reports that Solar Controls has not responded to requests to coordinate with NCCIC/ICS-CERT.

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit the vulnerability to allow arbitrary code execution.

HCDownloader Advisory

This advisory describes an uncontrolled search path element vulnerability in the Solar Controls Heating Control Downloader (HCDownloader). The vulnerability was reported by Karn Ganeshen. ICS-CERT reports that Solar Controls has not responded to requests to coordinate with NCCIC/ICS-CERT.

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit the vulnerability to allow arbitrary code execution.

SIMPlight Advisory

This advisory describes an uncontrolled search path element vulnerability in the the SIMPlight SCADA Software. ). The vulnerability was reported by Karn Ganeshen. ICS-CERT reports that Solar Controls has not responded to requests to coordinate with NCCIC/ICS-CERT.

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit the vulnerability to allow arbitrary code execution.