ICS-CERT Publishes New Advisory and an Update

Today the DHS ICS-CERT published a control system security advisory for protective relays from GE. They also updated a previously issued advisory for a product from Certec EDV GmbH.

GE Advisory

This advisory describes a weak cryptography for passwords vulnerability in the GE Multilin SR Protective Relays. The vulnerability was initially reported by Anastasis Keliris, Charalambos Konstantinou, Marios Sazos, and Dr. Michail (Mihalis) Maniatakos of New York University. GE has provided firmware updates for all but one of the affected devices; firmware for the final device is expected to be available in June. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to obtain weakly encrypted user passwords, which could be used to gain unauthorized access to affected products.

Certec EDV Update

This update provides additional information on the advisory that was originally published on April 6^th, 2017. This update provides the following new information:

• The vulnerabilities can be mitigated in the affected versions by activating the “the vendor built-in security mechanism”; and

• Provides an outline of the information needed to activate the security mechanism.

ICS-CERT Publishes Certec EDV Adivisory

Today the DHS ICS-CERT published a control system security advisory for two vulnerabilities in the Certec EDV atvise scada. The vulnerabilities were reported by Sebastian Neef of Internetwache.org. Certec has produced a new version of the software to mitigate the vulnerability. There is no indication that Neef has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Cross-Site Scripting - CVE-2017-6031; and

• Header Injection - CVE-2017-6029

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to execute arbitrary code, affecting the integrity of the device.