5 Advisories Published – 2-25-20

Yesterday the CISA NCCIC-ICS published five control system security advisories for products from Honeywell and Moxa (4).

Honeywell Advisory

This advisory describes three vulnerabilities in the Honeywell WIN-PAK monitoring platform. The vulnerabilities are self-reported. Honeywell has an update available that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Cross-site scripting - CVE-2020-7005;

• Improper neutralization of HTTP headers for scripting syntax - CVE-2020-6982; and

• Use of obsolete function - CVE-2020-6978

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerabilities to allow an attacker to perform remote code execution.

EDS-G516E Advisory

This advisory describes seven vulnerabilities in the Moxa EDS-G516E series, and EDS-510E series ethernet switches. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar, and Georgy Zaytsev of Positive Technologies. Moxa has new firmware that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The seven reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2020-7007;

• Use of broken or risky encryption algorithm - CVE-2020-7001;

• Use of hard-coded cryptographic key - CVE-2020-6979;

• Use of hard-coded credentials - CVE-2020-6981;

• Classic buffer overflow - CVE-2020-6989;

• Cleartext transmission of sensitive information - CVE-2020-6997; and

• Weak password requirements - CVE-2020-6991

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device, execute arbitrary code, and allow access to sensitive information.

PT-7528 Advisory

This advisory describes six vulnerabilities in the Moxa PT-7528 Series and PT-7828 Series ethernet switches. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar, and Georgy Zaytsev of Positive Technologies. Moxa has a security patch that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2020-6989;

• Use of broken or risky cryptographic algorithm - CVE-2020-6987

• Use of a hard-coded cryptographic key - CVE-2020-6983;

• Use of hard-coded credentials - CVE-2020-6985;

• Weak password requirements - CVE-2020-6995; and

• Information exposure - CVE-2020-6993

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device or allow access to sensitive information.

ioLogik 2542-HSPA Advisory

This advisory describes three vulnerabilities in the Moxa ioLogik 2542-HSPA Series Controllers and IOs, and IOxpress Configuration Utility. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar. Moxa has a security patch that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Clear-text storage of sensitive information - CVE-2019-18238;

• Clear-text transmission of sensitive information - CVE-2020-7003; and

• Incorrectly specified destination in a communication channel - CVE-2019-18242

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to crash the device or allow access to sensitive information.

MB3xxx Advisory

This advisory describes nine vulnerabilities in the Moxa MB3170 series, MB3180 series, MB3270 series, MB3280 series, MB3480 series, and MB3660 series protocol gateways. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar, and Georgy Zaytsev of Positive Technologies. Moxa has new firmware that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The nine reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2019-9099;

• Integer overflow to buffer overflow - CVE-2019-9098;

• Cross-site request forgery - CVE-2019-9102;

• Use of broken or risky encryption algorithm - CVE-2019-9095;

• Information exposure - CVE-2019-9103;

• Clear-text transmission of sensitive information - CVE-2019-9101;

• Weak password requirements - CVE-2019-9096;

• Clear-text storage of sensitive information - CVE-2019-9104; and

• Incorrectly specified destination in a communication channel - CVE-2019-9097

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device, cause a buffer overflow, allow remote execution of arbitrary code, or allow access to sensitive information.

NOTE: All four of these Moxa advisories cover vulnerabilities that were originally reported by Moxa on September 25^th, 2019.

Two Advisories Published – 01-24-19

Today the DHS NCCIC-ICS published two control system security advisories for products from Phoenix Contact and Advantech.

Phoenix Contact Advisory

This advisory describes six vulnerabilities in the Phoenix Contact FL SWITCH. The vulnerabilities were reported by Evgeniy Druzhinin, Ilya Karpov, and Georgy Zaytsev of Positive Technologies via CERT@VDE. Phoenix Contact reports that newer firmware versions mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Cross-site request forgery - CVE-2018-13993;

• Improper restriction of excessive authentication attempts - CVE-2018-13990;

• Cleartext transmission of sensitive information - CVE-2018-13992;

• Resource exhaustion - CVE-2018-13994;

• Insecure storage of sensitive information - CVE-2018-13991; and

• Memory corruption - CVE-2017-3735

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow attackers to have user privileges, gain access to the switch, read user credentials, deny access to the switch, or perform man-in-the-middle attacks.

NOTE: The CERT@VDE advisory notes that CVE-2018-13992 has not been fixed in the newer firmware versions available. A generic fix for that vulnerability has been recommended.

Advantech Advisory

This advisory describes three vulnerabilities in the Advantech WebAccess/SCADA platform.

The vulnerabilities were reported by Devesh Logendran of Attila Cybertech. Advantech has a new version that mitigates the vulnerabilities. There is no indication that Logendran has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper authentication - CVE-2019-6519:

• Authentication bypass using an alternate path or channel - CVE-2019-6521; and

• SQL injection - CVE-2019-6523

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to access and manipulate sensitive data.

ICS Public Disclosures – Week of 01-05-19

This week we have five new vendor disclosures and seven vendor updates, all for products from Siemens.

EN100 Ethernet Advisory

Siemens published an advisory for their EN100 Ethernet communication module for SWT 3000 describing two denial of service vulnerabilities. The vulnerabilities were reported by Victor Nikitin, Vladislav Suchkov, and Ilya Karpov from ScadaX. Siemens has identified a workaround that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

SICAM A8000 Advisory

Siemens published an advisory for their SICAM A8000 RTU series describing an denial of service vulnerability. The vulnerability was reported by Emanuel Duss and Nicolas Heiniger from Compass Security. Siemens has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

CP1604 and CP1616 Advisory

Siemens published an advisory for their CP1604 and CP1616 devices describing a denial of service vulnerability. The vulnerability is self-reported. Siemens has new versions that mitigate the vulnerability.

SIMATIC S7-300 Advisory

Siemens published an advisory for their SIMATIC S7-300 CPU describing a denial of service vulnerability. The vulnerability was reported by the Electronic Technology Information Research Institute. Siemens has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

S7-1500 Advisory

Siemens published an advisory for their S7-1500 CPU describing two denial of service vulnerabilities. The vulnerabilities were reported by Georgy Zaytsev, Dmitry Sklyarov, Druzhinin Evgeny, Ilya Karpov, and Maxim Goryachy from Positive Technologies. Siemens has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Siemens Updates

As part of the swath of 12 advisories and updates issued by Siemens this week there was one update that was not covered by NCCIC-ICS updates. This was for vulnerabilities addressed in ICS-CERT generic alerts; NCCIC-ICS does not update these alerts for new information from the existing vendor list on the alert, the links on those alerts already take interested parties to this latest information.

• SSB-439005: v 1.2 - Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP - Added CVE-2018-19931 and CVE-2018-19932;

There were six additional updates that I suspect that NCCIC-ICS could still pick-up in the coming week.

• SSA-592007: v 1.3 - Denial-of-Service Vulnerability in Industrial Products – NCCIC-ICS published their latest update (ICSA-18-079-02A) on October 9^th, 2018 - Added update for SIMATIC S7-300 incl. F and T;

• SSA-535640: v 1.3 - Vulnerability in Industrial Products – NCCIC-ICS published their latest update (ICSA-17-243-01B) on November 30^th, 2017 - Added fix for SIMATIC NET PC Software;

• SSA-348629: v 1.7 - Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional and SIMATIC NET PC Software - NCCIC-ICS published their latest update (ICSA-18-088-03E) on December 13^th, 2018 - Updated patch links for WinCC 7.2 and 7.4;

• SSA-346262: v 2.1 - Denial-of-Service in Industrial Products - NCCIC-ICS published their latest update (ICSA-17-339-01J) on December 12^th, 2018 - Updated solution for SIMATIC S7-300;4

• SSA-293562: v 2.6 - Vulnerabilities in Industrial Products - NCCIC-ICS published their latest update (ICSA-17-129-02N) on December 12^th, 2018 - Updated information for CP 1243-1; and

• SSA-181018: v 1.3 - Heap Overflow Vulnerability in SCALANCE X switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C - NCCIC-ICS published their original advisory (ICSA18-165-01) on June 13^th, 2018 - Added solution for RUGGEDCOM WiMAX

ICS-CERT Publishes 4 Advisories and 2 Siemens Updates

Today the DHS ICS-CERT published three control system security advisories for products from Delta Electronics, Siemens, Phoenix Contact, and Medtronic. They published on medical device security advisory for products from Medtronic. They also updated two previously issued control system security advisories for products from Siemens.

The three Siemens advisories/updates are the ones I mentioned in passing earlier this week.

Delta Advisory

This advisory describes a heap-based buffer overflow vulnerability in the Delta Industrial Automation TPEditor. The vulnerability was reported by ThePotato working with ZDI. Delta has released a new version that mitigates the vulnerability. There is no indication that the researcher was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to crash the accessed device, resulting in a buffer overflow condition that may allow remote code execution.

Siemens Advisory

This advisory describes an improper input validation vulnerability in the Siemens S7-400 CPU. The vulnerability is being self-reported. Siemens has updates that mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition of the CPU. The CPU will remain in DEFECT mode until a manual restart is performed. The Siemens security advisory notes that:

“Successful exploitation requires an attacker to be able to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security vulnerability”

Phoenix Contact Advisory

This advisory describes four vulnerabilities in the Phoenix FL SWITCH 3xxx/4xxx/48xx Series. The vulnerabilities were reported by  Vyacheslav Moskvin, Semen Sokolov, Evgeniy Druzhinin, Georgy Zaytsev and Ilya Karpov of Positive Technologies working through CERT@VDE. Newer firmware mitigates the vulnerability. There is no indication that any of the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Command injection - CVE-2018-10730;

• Information exposure - CVE-2018-10729; and

• Stack-based buffer overflow (2) - CVE-2018-10728, and CVE-2018-10731

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow for remote code execution and information disclosure.

GE Advisory

This advisory describes an improper input validation vulnerability n the GE PACSystems, an industrial Internet controller. The vulnerability was reported by Younes Dragoni of Nozomi Networks. GE has released new firmware to mitigate the vulnerability. There is no indication that Dragoni was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause the device to reboot and change its state, causing the device to become unavailable.

Medtronic Advisory

This advisory describes a missing encryption of sensitive data vulnerability in the Medtronic N’Vision Clinician Programmer. The vulnerability was reported by Billy Rios of Whitescope LLC. Medtronic has mitigated the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker with physical access to the card could exploit the vulnerability to access personal health information (PHI) or personally identifiable information (PII).

NOTE: This vulnerability was not reported on the FDA Medical Device Safety Communications page.

SIPROTEC Update #1

This update provides additional information on an advisory that was originally reported by ICS-CERT on May 19th, 2016 and updated on July 5^th, 2016. This update removes 7SD80 from list of affected products.

SIPROTEC Update #2

This update provides additional information on an advisory that was was originally published on March 8^th, 2018 and updated on April 19^th, 2018. This update provides updated effected version information and mitigation measures for 7SD80.