1 Advisory Published – 11-19-20

Today the CISA NCCIC-ICS published a control system security advisory for products from Mitsubishi.

Mitsubishi Advisory

This advisory describes an uncontrolled resource consumption vulnerability in the Mitsubishi MELSEC iQ-R series. The vulnerability was reported by Xiaofei.Zhang (of China ICS-CERT according to the Mitsubishi advisory). Mitsubishi has new firmware versions that mitigate the vulnerability. There is no indication that Ziaofei has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to cause a denial-of-service condition for the affected product.

NOTE 1: This is very similar to an advisory that was published last week. It is easier to understand the differences if you look at the Mitsubishi advisories. Last week’s advisory was for “MELSEC iQ-R Series CPU Modules” and today’s advisory is for “MELSEC iQ-R Series Ethernet Port”. This advisory affects a larger number of products. That explains why different products are affected in the two advisories.

NOTE 2: Something odd about the numbering of today’s advisory; “ICSA-20-324-05”. Typically, the last two digits are the sequence numbers for the day’s advisories, meaning that there should be four other advisories for today. When advisories are held for public release after restricted publication on Homeland Security Information Network (HSIN), they have a sequence number after the publicly published documents so that they do not ‘give away’ the fact that restricted access advisories have been published. So that is not the explanation. Looking at the three-character group before the sequence number we see the Julian day for the advisory. Today is the 324^th day of the year. Interestingly, the advisories that were published on Tuesday were also given advisory numbers starting with “ICSA-20-324-”. Apparently, a minor mistake was made on Tuesday. No big thing, I just like pointing out minor bureaucratic quirks.

2 Advisories Published – 11-12-20

Today the CISA NCCIC-ICS published one control system security advisory for products from Mitsubishi and one medical device security advisory for products from BD.

Mitsubishi Advisory

This advisory describes an uncontrolled resource consumption vulnerability in the Mitsubishi MELSEC iQ-R series CPU modules. The vulnerability was reported by Xiaofei.Zhang of China ICS-CERT. Mitsubishi has new firmware versions that mitigate the vulnerability. There is no indication that Ziaofei has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to cause a denial-of-service condition for the affected products.

BD Advisory

This advisory describes an improper authentication vulnerability in the BD Alaris 8015 PC Unit and BD Alaris Systems Manager. The vulnerability was reported by Medigate. BD has versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to lead to a drop in the wireless capability of the Alaris PC Unit. According to the BD advisory, the attacker “would need access to the customer's wireless network”.

NOTE: NCCIC-ICS did not provide a link to the BD advisory.