Public ICS Disclosures – Week of 8-15-20

This week we have three vendor disclosures for products from Phoenix Contact, Moxa, and Eaton and one update from Rockwell. There are researcher reports for products from WECON. There were two control system exploits published for products from PNPSCADA and Geutebruck.

Phoenix Contact Advisory

Phoenix Contact published an advisory [.PDF download link] describing a synchronous access of remote resource without timeout vulnerability in their Emalytics, ILC 2050 BI and ILC 2050 BI-L products. This is a third-party vulnerability in the Tridium Niagara product that was reported earlier this month by NCCIC-ICS. Phoenix Contact reports that they expect to fix this vulnerability in the next firmware update in October 2020.

Moxa Advisory

Moxa published an advisory describing six vulnerabilities in their NPort IAW5000A-I/O Series Serial Device Servers. The vulnerabilities were reported by Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar. Moxa has a new firmware version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Session fixation,

• Improper privilege management,

• Weak password requirements,

• Cleartext transmission of sensitive information,

• Improper restriction of excessive authentication attempts, and

• Information exposure

Eaton Advisory

Eaton published an advisory describing two vulnerabilities in their Secure Connect Android Mobile app. The vulnerability was reported by Vishal Bharad. Eaton has a new version that mitigates the vulnerabilities. There is no indication that Bharad has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Information exposure, and

• Information exposure through log files

Rockwell Update

Rockwell published an update for an advisory that was originally published on July 8^th, 2020 and most recently updated on July 23^rd, 2020. The new information includes links to additional detections.

WECON Reports

The Zero Day Initiative has published (ZDI-20-1055 thru ZDI-20-1076) 22 reports of 0-day vulnerabilities in the WECON LeviStudioU. The vulnerabilities have been reported to ‘ICS-CERT’ (presumably CISA NCCIC-ICS) which reportedly received no response from WECON. The vulnerabilities were reported by Natnael Samson. The vulnerabilities are all stack-based buffer overflows in various components of the LeviStudioU product. NO CVEs have been reported.

PNPSCADA Exploit

İsmail ERKEK published an exploit for an SQL injection vulnerability in the PNPSCADA. There is no CVE for this vulnerability and there is no indication that ERKEK has contacted the vendor, so this looks like it is a 0-day vulnerability.

Geutebruck Exploit

Davy Douhine published a Metasploit module for an authenticated arbitrary command execution vulnerability in Geutebruck G-Cam and G-Code cameras. This vulnerability was previously reported by NCCIC-ICS.

4 Advisories Published – 6-25-20

Today the CISA NCIC-ICS published three control system security advisories for products from Rockwell Automation (2) and ENTTEC. They also published a medical device security advisory for products from Philips.

FactoryTalk Advisory

This advisory describes two vulnerabilities in the Rockwell FactoryTalk View SE. The vulnerabilities were reported by Ilya Karpov and Evgeny Druzhinin of ScadaX Security. Rockwell has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Cleartext transmission of sensitive information - CVE-2020-14480, and

• Weak encoding for passwords - CVE-2020-14481

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to lead to unauthorized access to server data.

NOTE: NCCIC-ICS did not publish a link to the Rockwell advisory.

FactoryTalk Services Advisory

This advisory describes an improper restriction of XML external entity reference vulnerability in the Rockwell FactoryTalk Services Platform. The vulnerability was reported by Applied Risk. Rockwell has a patch that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to lead to a denial-of-service condition and to the arbitrary reading of any local file via system level services.

NOTE: NCCIC-ICS did not publish a link to the Rockwell advisory.

ENTTEC Advisory

This advisory describes four vulnerabilities in the ENTTEC Datagate Mk2, Storm 24, Pixelator, E-Streamer Mk2 lighting control products. The vulnerabilities were reported (report includes proof-of-concept exploit code) by Mark Cross. ENTTEC has not yet offered mitigation measures for these vulnerabilities.

The four reported vulnerabilities are:

• Hard-coded cryptographic key - CVE-2019-12776,

• Cross-site scripting - CVE-2019-12774,

• Improper access control - CVE-2019-12775, and

• Improper permission assignment for critical resource - CVE-2019-12777

NCCIC-ICS reports that a relatively low-skilled attacker with remote access could use publicly available code to remotely exploit the vulnerability to allow an attacker to gain unauthorized SSH/SCP access to devices, inject malicious code, run commands with root privileges, and read, write, and execute files in system directories as any user.

Philips Advisory

This advisory describes an authentication bypass using alternate path or channel vulnerability in the Philips Ultrasound Systems. The vulnerability is self-reported. Philips has a new version that mitigates the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to allow a non-authenticated attacker to view or modify information. The Phillips advisory reports that it would take a relatively high-skilled attacker with local access to exploit the vulnerability.

Public ICS Disclosure – Week of 2-29-20

This week we have lots of new ‘information’ on SweynTooth vulnerabilities and three vendor disclosures for products from Rockwell, Phoenix Contact and Moxa.

SweynTooth

In addition to the CISA alert for the SweynTooth  Bluetooth vulnerabilities published this week there was an advisory from the FDA and brief disclosures from the following medical device vendors:

• GE Healthcare;  

• Johnson and Johnson;

• Medtronic;

• BD; and

• Drager

Rockwell Advisory

Rockwell published an advisory describing four vulnerabilities in their MicroLogix Controllers and RSLogix 500 Software. The vulnerabilities were reported by Ilya Karpov, Evgeny Druzhinin from ScadaX Security and Dmitry Sklyarov from Positive Technologies. Rockwell has new versions for some products that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Use of hard-coded cryptographic key - CVE-2020-6990;

• Use of broken or risky algorithm for password protection - CVE-2020-6984;

• Use of client-side authentication - CVE-2020-6988; and

• Unsecured SMTP data storage - CVE-2020-6980

Phoenix Contact Advisory

Phoenix Contact published an advisory [.PDF download link] describing three vulnerabilities in their  TC ROUTER & TC CLOUD CLIENT devices. The vulnerabilities were reported by Thomas Weber, SEC Consult Vulnerability Lab. Phoenix Contact has new firmware that mitigates the vulnerability. There is no indication that Weber was provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper control of generation of code - CVE-2017-16544;

• Command injection - CVE-2020-9436; and

• Hard-coded certificate - CVE-2020-9435

NOTE: the first vulnerability is an old library problem that has lots of exploits available.

Moxa Advisory

Moxa published an advisory describing an improper authentication vulnerability in their MGate MB3180/MB3280/MB3480/MB3170/MB3270 Series Protocol Gateways. This is a self-reported vulnerability. Moxa has new firmware versions available that mitigate the vulnerability.

5 Advisories Published – 2-25-20

Yesterday the CISA NCCIC-ICS published five control system security advisories for products from Honeywell and Moxa (4).

Honeywell Advisory

This advisory describes three vulnerabilities in the Honeywell WIN-PAK monitoring platform. The vulnerabilities are self-reported. Honeywell has an update available that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Cross-site scripting - CVE-2020-7005;

• Improper neutralization of HTTP headers for scripting syntax - CVE-2020-6982; and

• Use of obsolete function - CVE-2020-6978

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerabilities to allow an attacker to perform remote code execution.

EDS-G516E Advisory

This advisory describes seven vulnerabilities in the Moxa EDS-G516E series, and EDS-510E series ethernet switches. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar, and Georgy Zaytsev of Positive Technologies. Moxa has new firmware that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The seven reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2020-7007;

• Use of broken or risky encryption algorithm - CVE-2020-7001;

• Use of hard-coded cryptographic key - CVE-2020-6979;

• Use of hard-coded credentials - CVE-2020-6981;

• Classic buffer overflow - CVE-2020-6989;

• Cleartext transmission of sensitive information - CVE-2020-6997; and

• Weak password requirements - CVE-2020-6991

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device, execute arbitrary code, and allow access to sensitive information.

PT-7528 Advisory

This advisory describes six vulnerabilities in the Moxa PT-7528 Series and PT-7828 Series ethernet switches. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar, and Georgy Zaytsev of Positive Technologies. Moxa has a security patch that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2020-6989;

• Use of broken or risky cryptographic algorithm - CVE-2020-6987

• Use of a hard-coded cryptographic key - CVE-2020-6983;

• Use of hard-coded credentials - CVE-2020-6985;

• Weak password requirements - CVE-2020-6995; and

• Information exposure - CVE-2020-6993

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device or allow access to sensitive information.

ioLogik 2542-HSPA Advisory

This advisory describes three vulnerabilities in the Moxa ioLogik 2542-HSPA Series Controllers and IOs, and IOxpress Configuration Utility. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar. Moxa has a security patch that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Clear-text storage of sensitive information - CVE-2019-18238;

• Clear-text transmission of sensitive information - CVE-2020-7003; and

• Incorrectly specified destination in a communication channel - CVE-2019-18242

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to crash the device or allow access to sensitive information.

MB3xxx Advisory

This advisory describes nine vulnerabilities in the Moxa MB3170 series, MB3180 series, MB3270 series, MB3280 series, MB3480 series, and MB3660 series protocol gateways. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin from Rostelecom-Solar, and Georgy Zaytsev of Positive Technologies. Moxa has new firmware that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The nine reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2019-9099;

• Integer overflow to buffer overflow - CVE-2019-9098;

• Cross-site request forgery - CVE-2019-9102;

• Use of broken or risky encryption algorithm - CVE-2019-9095;

• Information exposure - CVE-2019-9103;

• Clear-text transmission of sensitive information - CVE-2019-9101;

• Weak password requirements - CVE-2019-9096;

• Clear-text storage of sensitive information - CVE-2019-9104; and

• Incorrectly specified destination in a communication channel - CVE-2019-9097

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device, cause a buffer overflow, allow remote execution of arbitrary code, or allow access to sensitive information.

NOTE: All four of these Moxa advisories cover vulnerabilities that were originally reported by Moxa on September 25^th, 2019.

2 Advisories Published – 11-26-19

Today the CISA NCCIC-ICS published two control system security advisories for products from ABB.

ABB Advisory #1

This advisory describes a path traversal vulnerability in the ABB Relion 670 series. The vulnerability was reported by Kirill Nesterov of Kaspersky Lab. ABB has new versions that mitigate the vulnerability. There is no indication that Nesterov has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to read and delete files on the device.

ABB Advisory #2

This advisory describes an improper input validation vulnerability in the ABB  Relion 650 and 670 Series. The vulnerability was reported by Ilya Karpov, Evgeniy Druzhinin, and Victor Nikitin of ScadaX. ABB has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to reboot the device, causing a denial of service.

NOTE: I briefly reported on both of these vulnerabilities and a third that was also reported by ABB on the same day back in October. The third advisory dealt with OpenSSL vulnerabilities.

Public ICS Disclosures – Week of 10-19-19

This week we have three vendor disclosures from ABB and two vendor updates from 3S and Yokogawa. There is also an exploit report for previously reported vulnerabilities in products from Moxa.

ABB Advisories

Relion® 670 series

ABB published an advisory describing a path traversal vulnerability in the MMS server included in their Relion 670 series protection and control IEDs. The vulnerability was reported by Kirill Nesterov of Kaspersky Lab. ABB has new versions that mitigate the vulnerability. There is no indication that Nesterov has been provided an opportunity to verify the efficacy of the fix.

Relion® 650 series and Relion® 670 series

ABB published an advisory describing a terminal reboot vulnerability in the SPA protocol over TCP/IP included in their Relion 650 and 670 series protection and control IEDs. The vulnerability was reported by Ilya Karpov, Evgeniy Druzhinin, Damir Zainullin of Positive Technologies and Victor Nikitin of i-Grids. ABB has updates that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Relion® 650 series and Relion® 670 series

ABB published an advisory describing four known OpenSSL vulnerabilities (CVE-2017-3737, CVE-2018-0739, CVE-2018-0737, CVE-2018-0732) in their Relion 650 and 670 series protection and control IEDs. These vulnerabilities are self-reported. ABB has updates that mitigate the vulnerabilities.

3S Update

3S published an update an advisory that was originally published on September 12^th, 2019. The new information includes:

• Revised affected version numbers;

• Added CVE number for vulnerability; and

• Revised version number for mitigation

Yokogawa Update

Yokogawa published an update for an advisory that was originally published on September 27^th, 2019 and most recently updated on October 11^th, 2019. The new information includes a link to the patch for the Exaquantum product.

Moxa Exploit

RANDORISEC published exploit code for two vulnerabilities in the Moxa Moxa EDR-810 Series Secure Routers. One of these vulnerabilities was addressed in an NCCIC-ICS advisory published on October 1^st, 2019. The second vulnerability was reported in a Moxa advisory published on October 2^nd, 2019.

2 Advisories and 3 Updates Published – 02-07-19

Today the DHS NCCIC-ICS published two control system advisories for products from Siemens and three updates for products from Kunbus, Omron and Fuji electric.

EN100 Advisory

This advisory describes two improper input validation vulnerabilities in the Siemens EN100 Ethernet module. These vulnerabilities were reported by Victor Nikitin, Vladislav Suchkov, and Ilya Karpov from ScadaX. Siemens has provided updates for some of the affected products. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to conduct a denial-of-service attack over the network.

NOTE: I briefly discussed this update on January 12^th.

SICAM Advisory

This advisory describes an uncaught exception vulnerability in the Siemens SICAM A8000 RTU. The vulnerability was reported by Emanuel Duss and Nicolas Heiniger from Compass Security. Siemens has updates that mitigate the vulnerability. There is no indication that the researchers have been offered an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow unauthenticated remote users to cause a denial-of-service condition on the web server of affected products.

NOTE: I briefly discussed this update on January 12^th.

Siemens Update – There are two advisories from the January 8^th tranche of vulnerability disclosures from Siemens. It will be interesting to see if they are processed by NCCIC-ICS before the next scheduled Siemens advisory disclosures on February 12^th.

Kunbus Update

This update provides additional information on an advisory that was originally published on February 5^th, 2019. The update includes:

• Adding two additional vulnerabilities (Information exposure through query strings in get request and clear-text storage of sensitive information); and

• Report that the two added vulnerabilities will be mitigated in the next version (end of the month).

Omron Update

This update provides additional information on an advisory that was originally published on January 17^th, 2019. The update includes:

• Adding two additional vulnerabilities (access of uninitialized pointer and out-of-bounds read); and

• Added Michael DePlante as a vulnerability reporter;

Fuji Update

This update provides additional information on an advisory that was originally published on September 27^th, 2018. The updates reports that a new version is available that mitigates the vulnerability.

Two Advisories Published – 01-24-19

Today the DHS NCCIC-ICS published two control system security advisories for products from Phoenix Contact and Advantech.

Phoenix Contact Advisory

This advisory describes six vulnerabilities in the Phoenix Contact FL SWITCH. The vulnerabilities were reported by Evgeniy Druzhinin, Ilya Karpov, and Georgy Zaytsev of Positive Technologies via CERT@VDE. Phoenix Contact reports that newer firmware versions mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Cross-site request forgery - CVE-2018-13993;

• Improper restriction of excessive authentication attempts - CVE-2018-13990;

• Cleartext transmission of sensitive information - CVE-2018-13992;

• Resource exhaustion - CVE-2018-13994;

• Insecure storage of sensitive information - CVE-2018-13991; and

• Memory corruption - CVE-2017-3735

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow attackers to have user privileges, gain access to the switch, read user credentials, deny access to the switch, or perform man-in-the-middle attacks.

NOTE: The CERT@VDE advisory notes that CVE-2018-13992 has not been fixed in the newer firmware versions available. A generic fix for that vulnerability has been recommended.

Advantech Advisory

This advisory describes three vulnerabilities in the Advantech WebAccess/SCADA platform.

The vulnerabilities were reported by Devesh Logendran of Attila Cybertech. Advantech has a new version that mitigates the vulnerabilities. There is no indication that Logendran has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper authentication - CVE-2019-6519:

• Authentication bypass using an alternate path or channel - CVE-2019-6521; and

• SQL injection - CVE-2019-6523

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to access and manipulate sensitive data.

ICS Public Disclosures – Week of 01-05-19

This week we have five new vendor disclosures and seven vendor updates, all for products from Siemens.

EN100 Ethernet Advisory

Siemens published an advisory for their EN100 Ethernet communication module for SWT 3000 describing two denial of service vulnerabilities. The vulnerabilities were reported by Victor Nikitin, Vladislav Suchkov, and Ilya Karpov from ScadaX. Siemens has identified a workaround that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

SICAM A8000 Advisory

Siemens published an advisory for their SICAM A8000 RTU series describing an denial of service vulnerability. The vulnerability was reported by Emanuel Duss and Nicolas Heiniger from Compass Security. Siemens has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

CP1604 and CP1616 Advisory

Siemens published an advisory for their CP1604 and CP1616 devices describing a denial of service vulnerability. The vulnerability is self-reported. Siemens has new versions that mitigate the vulnerability.

SIMATIC S7-300 Advisory

Siemens published an advisory for their SIMATIC S7-300 CPU describing a denial of service vulnerability. The vulnerability was reported by the Electronic Technology Information Research Institute. Siemens has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

S7-1500 Advisory

Siemens published an advisory for their S7-1500 CPU describing two denial of service vulnerabilities. The vulnerabilities were reported by Georgy Zaytsev, Dmitry Sklyarov, Druzhinin Evgeny, Ilya Karpov, and Maxim Goryachy from Positive Technologies. Siemens has new versions that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Siemens Updates

As part of the swath of 12 advisories and updates issued by Siemens this week there was one update that was not covered by NCCIC-ICS updates. This was for vulnerabilities addressed in ICS-CERT generic alerts; NCCIC-ICS does not update these alerts for new information from the existing vendor list on the alert, the links on those alerts already take interested parties to this latest information.

• SSB-439005: v 1.2 - Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP - Added CVE-2018-19931 and CVE-2018-19932;

There were six additional updates that I suspect that NCCIC-ICS could still pick-up in the coming week.

• SSA-592007: v 1.3 - Denial-of-Service Vulnerability in Industrial Products – NCCIC-ICS published their latest update (ICSA-18-079-02A) on October 9^th, 2018 - Added update for SIMATIC S7-300 incl. F and T;

• SSA-535640: v 1.3 - Vulnerability in Industrial Products – NCCIC-ICS published their latest update (ICSA-17-243-01B) on November 30^th, 2017 - Added fix for SIMATIC NET PC Software;

• SSA-348629: v 1.7 - Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional and SIMATIC NET PC Software - NCCIC-ICS published their latest update (ICSA-18-088-03E) on December 13^th, 2018 - Updated patch links for WinCC 7.2 and 7.4;

• SSA-346262: v 2.1 - Denial-of-Service in Industrial Products - NCCIC-ICS published their latest update (ICSA-17-339-01J) on December 12^th, 2018 - Updated solution for SIMATIC S7-300;4

• SSA-293562: v 2.6 - Vulnerabilities in Industrial Products - NCCIC-ICS published their latest update (ICSA-17-129-02N) on December 12^th, 2018 - Updated information for CP 1243-1; and

• SSA-181018: v 1.3 - Heap Overflow Vulnerability in SCALANCE X switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C - NCCIC-ICS published their original advisory (ICSA18-165-01) on June 13^th, 2018 - Added solution for RUGGEDCOM WiMAX

ICS Public Disclosure – Week of 07-07-18

This week we have two vendor disclosures from Siemens and WAGO with a concurrent publication of exploit code for the WAGO vulnerabilities.

Siemens Advisory

This advisory describes two denial of service vulnerabilities in the Siemens EN100 Ethernet communication module and SIPROTEC 5 relays. The vulnerabilities were reported by Victor Nikitin, Vladislav Suchkov, and Ilya Karpov from ScadaX. Siemens recommends blocking access to port 102/tcp e.g. with an external firewall.

WAGO Advisory

This VDE-CERT advisory describes three vulnerabilities in the WAGO e!DISPLAY. The vulnerabilities were reported by SEC Consult. WAGO has a new firmware version that mitigates the vulnerabilities. There is no indication that SEC Consult has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper neutralization of input during web page generation - CVE-2018-12981;

• Unrestricted upload of file with dangerous type - CVE-2018-12980; and

• Incorrect permission assignment for critical resource - CVE-2018-12979

The day after VDE-CERT released this advisory SEC Consult published exploit code for all three vulnerabilities on their web site and other locations (see here for example).

ICS-CERT Publishes 4 Advisories and 2 Siemens Updates

Today the DHS ICS-CERT published three control system security advisories for products from Delta Electronics, Siemens, Phoenix Contact, and Medtronic. They published on medical device security advisory for products from Medtronic. They also updated two previously issued control system security advisories for products from Siemens.

The three Siemens advisories/updates are the ones I mentioned in passing earlier this week.

Delta Advisory

This advisory describes a heap-based buffer overflow vulnerability in the Delta Industrial Automation TPEditor. The vulnerability was reported by ThePotato working with ZDI. Delta has released a new version that mitigates the vulnerability. There is no indication that the researcher was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to crash the accessed device, resulting in a buffer overflow condition that may allow remote code execution.

Siemens Advisory

This advisory describes an improper input validation vulnerability in the Siemens S7-400 CPU. The vulnerability is being self-reported. Siemens has updates that mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition of the CPU. The CPU will remain in DEFECT mode until a manual restart is performed. The Siemens security advisory notes that:

“Successful exploitation requires an attacker to be able to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security vulnerability”

Phoenix Contact Advisory

This advisory describes four vulnerabilities in the Phoenix FL SWITCH 3xxx/4xxx/48xx Series. The vulnerabilities were reported by  Vyacheslav Moskvin, Semen Sokolov, Evgeniy Druzhinin, Georgy Zaytsev and Ilya Karpov of Positive Technologies working through CERT@VDE. Newer firmware mitigates the vulnerability. There is no indication that any of the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Command injection - CVE-2018-10730;

• Information exposure - CVE-2018-10729; and

• Stack-based buffer overflow (2) - CVE-2018-10728, and CVE-2018-10731

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow for remote code execution and information disclosure.

GE Advisory

This advisory describes an improper input validation vulnerability n the GE PACSystems, an industrial Internet controller. The vulnerability was reported by Younes Dragoni of Nozomi Networks. GE has released new firmware to mitigate the vulnerability. There is no indication that Dragoni was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause the device to reboot and change its state, causing the device to become unavailable.

Medtronic Advisory

This advisory describes a missing encryption of sensitive data vulnerability in the Medtronic N’Vision Clinician Programmer. The vulnerability was reported by Billy Rios of Whitescope LLC. Medtronic has mitigated the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker with physical access to the card could exploit the vulnerability to access personal health information (PHI) or personally identifiable information (PII).

NOTE: This vulnerability was not reported on the FDA Medical Device Safety Communications page.

SIPROTEC Update #1

This update provides additional information on an advisory that was originally reported by ICS-CERT on May 19th, 2016 and updated on July 5^th, 2016. This update removes 7SD80 from list of affected products.

SIPROTEC Update #2

This update provides additional information on an advisory that was was originally published on March 8^th, 2018 and updated on April 19^th, 2018. This update provides updated effected version information and mitigation measures for 7SD80.

ICS-CERT Publishes Alert, 3 Advisories and 1 Update

Yesterday ICS-CERT published an alert for the Intel Meltdown and Spectre vulnerabilities. They published three control system security advisories for products from Phoenix Contact, Moxa, and WECON. They also updated a previously published advisory for products from Advantech.

Meltdown Alert

This alert describes the CPU hardware vulnerable to side-channel attacks vulnerabilities known as  Meltdown and Spectre. The alert provides links to the following vendor notifications about these vulnerabilities:

• ABB;

• Becton, Dickinson and Company (BD); 

• Rockwell Automation (account required for login); and

• Siemens

The alert also provides a generic link to the ICS-CERT recommended practices page. It is disappointing that, in light of the problems seen with the Windows Update for Meltdown seen on some systems (here and here for example), ICS-CERT has not specifically mentioned the need for checking any updates on a test platform before uploading to a live control system.

Phoenix Contact Advisory

This advisory describes two vulnerabilities in the Phoenix Contact FL Switch product line. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin of Positive Technologies. Newer versions of the firmware mitigate these vulnerabilities. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper authorization - CVE-2017-16743; and

• Information exposure - CVE-2017-16741

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to gain administrative privileges and expose information to unauthenticated users.

Moxa Advisory

This advisory describes an unquoted search path vulnerability in the Moxa MXview network management software. The vulnerability was reported by Karn Ganeshen. Moxa has produced a firmware update that mitigates the vulnerability. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker with locally authorized access could exploit the vulnerability to escalate privileges by inserting arbitrary code into the unquoted service path.

WECON Advisory

This advisory describes two vulnerabilities in the WECON LeviStudio HMI Editor. The vulnerabilities were reported by Sergey Zelenyuk of RVRT, HanM0u of CloverSec Labs, and Brian Gorenc via the Zero Day Initiative. The latest version of the software mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2017-16739; and

• Heap-based buffer overflow - CVE-2017-16737

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to effect arbitrary code execution.

Advantech Update

This update updates information on an advisory that was originally published on January 4^th, 2018. This update adds two vulnerabilities to those previously reported:

• Unrestricted upload of file with dangerous type - CVE-2017-16736 and

• Use after free - CVE-2017-16732

ICS-CERT Publishes 5 Advisories and 2 Updates

Today the DHS ICS-CERT published five control system security advisories, two products from Schneider Electric and three from Siemens. It also published updates for two previously published advisories for products from Siemens.

Ampla Advisory

This advisory describes two vulnerabilities in the Schneider Ampla MES products. The vulnerabilities were reported by Ilya Karpov from Positive Technologies. Schneider reports that the current version of the products mitigates the vulnerability. There is no indication that Karpov has been provided an opportunity to verify the efficacy of the fix.

The reported vulnerabilities are:

• Clear text transmission of sensitive information - CVE-2017-9637; and

• Inadequate encryption strength - CVE-2017-9635

ICS-CERT reports that a relatively unskilled attacker (with uncharacterized access) can exploit the vulnerabilities to connect to third party databases or compromise credentials of Ampla users configured with Simple Security. The Schneider security bulletin notes that configuring the products configured with Windows Integrated Security avoid these vulnerabilities.

Comment: I always wonder when a current version of a product mitigates a previously unreported vulnerability in earlier versions if the problem was corrected by ‘accident’ or if the vendor had discovered the vulnerability and fixed it without specifically identifying the vulnerability to its customers. If it is the later, they are doing their customers a disservice by not identifying the vulnerability so that owners can make an appropriate, risk-based decision to upgrade or not.

Wonderware Advisory

This advisory describes three vulnerabilities in the Schneider Wonderware ArchestrA Logger. The vulnerability was reported by Andrey Zhukov of USSC. Schneider has developed a security patch to mitigate the vulnerability. There is no indication that Zhukov was provided an opportunity to verify the efficacy of the fix. The Schneider security bulletin, however, indicates that Zhukov has verified the efficacy of the fix.

The reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2017-9629;

• Uncontrolled resource consumption - CVE-2017-9627; and

• Null pointer deference - CVE-2017-9631

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to execute code or cause a denial of service.

SIPROTEC Advisory

This advisory describes six vulnerabilities in the Siemens SIPROTEC 4 and SIPROTEC Compact devices. Siemens has self-reported the vulnerability. Siemens developed a firmware updates to mitigate the vulnerability.

The reported vulnerabilities are:

• Improper input validation - CVE-2015-5374 and CVE-2016-7113;

• Missing authorization - CVE-2016-4784, CVE-2016-4785, and CVE-2016-7112; and

• Improper authentication - CVE-2016-7114

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to allow an attacker access to sensitive information, or allow an attacker to perform administrative functions. The Siemens security advisory reports that two of the vulnerabilities could allow the attacker to conduct a denial of service attack.

Reyrolle Advisory

This advisory describes five vulnerabilities in the Siemens Reyrolle products. Siemens has self-reported the vulnerability. Siemens has developed a new firmware version to mitigate the vulnerabilities.

The reported vulnerabilities are:

• Missing authorization - CVE-2016-4784, CVE-2016-4785 and CVE-2016-7112;

• Improper input validation - CVE-2016-7113; and

• Improper authentication - CVE-2016-7114

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to access sensitive device information, circumvent authentication, and perform administrative actions. The Siemens security bulletin notes that an attacker needs to have network access to the device.

OZW672 and OZW772 Advisory

This advisory describes two vulnerabilities in the Siemens OZW672 and OZW772 devices. The vulnerabilities were reported by Stefan Viehböck from SEC Consult. Siemens has provided work arounds to mitigate the vulnerabilities, but there is no indication that a more permanent fix is in the offing.

The two reported vulnerabilities are:

• Missing authentication for critical function - CVE-2017-6872 and CVE-2017-6873

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to read and write historical measurement data under certain conditions, or to read and modify data in TLS sessions.

PROFINET Update

This update provides new information on an advisory that was originally published on May 9^th, 2017 and updated on June 15^th, 2017, and then again on June 20^th, 2017. The update provides new affected version information and mitigation measures for SIMATIC PCS 7: All versions prior to V9.0.

SIMATIC Update

This update provides new information on an advisory that was originally published on February 14^th, 2017 and updated on June 15^th, 2017. The update provides new affected version information for:

• SIMATIC PCS 7: All versions prior to V9.0, and

• SIMATIC PDM: All versions prior to V9.1

ICS-CERT Publishes 3 Advisories

Today the DHS ICS-CERT published two industrial control system advisories for products from Rockwell and Moxa. They also published a medical control system advisory for products from B Braun Medical. The Rockwell advisory was previously published on the NCCIC Portal on April 25^th, 2017. The Braun Medical advisory was previously published on the NCCIC Portal on March 23^rd, 2017l

B Braun Medical Advisory

This advisory describes an open redirect vulnerability on the B Braun Medical SpaceCom module. The vulnerability was reported by Marc Ruef and Rocco Gagliardi of scip AG. Braun has produced a software update that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to  allow URL redirection to untrusted web sites.

Rockwell Advisory

This advisory describes multiple vulnerabilities in the Allen-Bradley MicroLogix 1100 and 1400 PLCs. The three of the vulnerabilities were reported by David Formby and Raheem Beyah of Georgia Tech and Fortiphyd Logic, Inc with the last one being reported by Ilya Karpov of Positive Technologies. Rockwell has provided a firmware update for one of the affected products and recommends disabling the web server as an alternative and/or additional mitigation measure. There is no indication that the researchers have been provide an opportunity to verify the efficacy of the fix.

The reported vulnerabilities are:

• Predictable value range from previous values - CVE-2017-7901;

• Reusing a nonce, key pair in encryption - CVE-2017-7902;

• Information exposure - CVE-2017-7899;

• Improper restriction of excessive authentication attempts- CVE-2017-7898; and

• Weak password requirements - CVE-2017-7903

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerabilities  to gain unauthorized access to the affected programmable logic controllers and to spoof or disrupt TCP connections.

Moxa Advisory

This advisory describes three vulnerabilities in the Moxa OnCell IP gateways. The vulnerabilities were reported by Maxim Rupp. Moxa reports that the latest version of two of the products mitigate the vulnerabilities and provides a work around for the remainder. There is no indication that Rupp was provided an opportunity to verify the efficacy of the fix.

The reported vulnerabilities are:

• Improper restriction of excessive authentication attempts - CVE-2017-7915;

• Plain text storage of a password - CVE-2017-7913; and

• Cross-site request forgery - CVE-2017-7917

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to allow an attacker to use brute force to determine parameters needed to access the application. An attacker may also obtain credentials by obtaining files that store passwords in clear text.

ICS-CERT Publishes Two Advisories

Today the DHS ICS-CERT published two control system security advisories for products from GE and Phoenix Contact. The GE advisory was previously published on the NCCIC Portal on December 1^st, 2016.

GE Advisory

This advisory describes an insufficiently protected credentials vulnerability in the GE Proficy Human-Machine Interface/Supervisory Control and Data Acquisition (HMI/SCADA) iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian software. The vulnerability was reported by Ilya Karpov of Positive Technologies. GE has produced new versions that mitigate the vulnerability. There is no indication that Karpov has been provided the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a highly skilled attacker could exploit the vulnerability with local access and user interaction. This, however, was the vulnerability that ICS-CERT thought posed enough of a threat to critical infrastructure that it required advance notice to critical infrastructure facilities.

Phoenix Contact Advisory

This advisory describes a default password vulnerability in the Phoenix Contact mGuard product that was induced in the system by updating with version 8.4.1. Phoenix Contact self-reported this vulnerability.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability.

ICS-CERT Published Two Rockwell Advisories

Today the DHS ICS-CERT published two control system security advisories for products from Rockwell Automation. Both advisories were previously published on the NCCIC Portal library (formerly US-CERT Secure Portal) to provide critical infrastructure owners time to implement mitigation measures before the vulnerabilities were publicly reported.

MicroLogix Advisory

This advisory describes two vulnerabilities in the Rockwell Allen-Bradley MicroLogix 1100 and 1400 programmable logic controller (PLC) systems. The vulnerabilities were reported by Alexey Osipov and Ilya Karpov of Positive Technologies. Rockwell has developed new firmware versions to mitigate the vulnerabilities. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Clear-text transmission of sensitive information - CVE-2016-9334; and

• Incorrect permission assignment for critical resource - CVE-2016-9338;

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to gain unauthorized access to affected devices, as well as impact the availability of affected devices.

Logix Advisory

This advisory describes a buffer overflow vulnerability in the Rockwell Automation Logix5000 Programmable Automation Controller product line. The vulnerability is apparently self-reported. Rockwell has developed new firmware versions to mitigate the vulnerability.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to cause a denial of service at a controller or execute code on a target controller.

ICS-CERT Publishes Two Advisories

This morning the DHS ICS-CERT published two control system advisories from products from ABB and Moxa.

ABB Advisory 

This advisory describes multiple credential vulnerabilities in the ABB PCM600. The vulnerability by Ilya Karpov from Positive Technologies. ABB has produced a new version to mitigate the vulnerabilities. There is no indication that Karpov has been provided an opportunity to verify the efficacy of the fix.

The vulnerabilities include:

• Use of password hash with insufficient computational effort - CVE-2016-4511; and

• Insufficiently protected credential - CVE-2016-4516, CVE-2016-4524, and CVE-2016-4527

ICS-CERT reports that a relatively unskilled attacker with local access to the computer running PCM6000 to edit the main application or gain access to PCM600 or connected devices.

ABB publishes a Cyber Security Deployment Guideline for the PCM600.

Moxa Advisory

This advisory describes a firmware overwrite vulnerability in the Moxa UC 7408-LX-Plus. The advisory reports that ICS-CERT was notified by ‘a third-party’ that identified the vulnerability. A thinking reader might guess that the ‘third-party’ was someone associated with the investigation of the Ukraine power outage (see pg 4, a third-of-the-way down the page). Moxa has produced instructions for a workaround, but no firmware update (ironically) is expected because the device has been discontinued.

ICS-CERT reports that a relatively unskilled attacker…. Nope they actually said that: “Crafting a working exploit for this vulnerability would be difficult. Root level access is necessary for this exploit. This decreases the likelihood of a successful exploit.” The fact that an actual exploit has been very publicly executed will be used to cast aspersions on all future uses of this phrase by ICS-CERT.

Interesting side note in the advisory. It seems like a successful exploit of this vulnerability essentially bricks the device beyond recovery.

ICS-CERT Updates one Advisory and Publishes Another

This afternoon the DHS ICS-CERT updated a Siemens advisory for SIMATIC HMI Devices and publishes a new advisory for Schneider Electric InduSoft Wb Studio.

Siemens Update

This update notes that Siemens is now reporting that all of the affected HMI devices now have updates available to mitigate the three vulnerabilities reported in the original advisory back in April. It also adds three different types of SIMATIC HMI panels to the list of affected and mitigated products.

Schneider Advisory

This advisory describes a clear-text storage of sensitive information vulnerability in Schneider’s Electric InduSoft Web Studio and InTouch Machine. The vulnerability was originally reported by Gleb Gritsai, Alisa Esage Shevchenko, Ilya Karpov, and the team from Positive Technologies Security. Schneider has produced patches to mitigate the vulnerability but there is no indication that the researchers have been given the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker with local access can obtain project passwords from the configuration file. These can then be used to execute arbitrary code.

NOTE: The link provided in the Advisory for the Schneider report on the InduSoft version of this vulnerability does not get to the report; Schneiderdoes not yet have the vulnerability listed. Here is the direct link.

ICS-CERT Publishes Siemens HMI Advisory

This morning the DHS ICS-CERT published an advisory for multiple vulnerabilities in a variety of Siemens HMI devices. The vulnerabilities were reported by the Quarkslab team and Ilya Karpov from Positive Technologies. Siemens has produced updates for most affected products (others are still in the works) but there is no indication that the researchers have been provided an opportunity to verify the efficacy of the fixes.

The vulnerabilities are:

∙ Man-in-the-Middle - CVE-2015-1601;

∙ Resource exhaustion - CVE-2015-2822; and

∙ Use of password hash instead of password for authentication - CVE-2015-2823

ICS-CERT reports that a moderately skilled attacker could remotely exploit these vulnerabilities to conduct man-in-the-middle attacks, denial‑of‑ service attacks, and possibly authenticate themselves as valid users depending on the vulnerability exploited.

With the large number of systems susceptible to these vulnerabilities I would suspect that they were only reported in one or two systems by the researchers. This would fit with the recent Siemens history of self-identifying vulnerabilities. If true Siemens is to be congratulated on their commitment improving the security of their systems. Some vendors recently identified with vulnerabilities in a portion of their product line would do well to emulate the Siemens model and proactively determine if the same vulnerability affects similar devices.

NOTE 1: It only took ICS-CERT a day to publish this advisory, they are getting better. My TWITTER followers will remember that this was announced yesterday morning my Siemens.

NOTE 2: Siemens appears to have developed a complicated internal method of determining when ‘enough’ systems have protections available to make it worthwhile to publish their advisories. We have seen this in a number of instances lately where ‘most’ of the affected systems have fixes in place and the other fixes come out over subsequent weeks and months. I hope that the researchers involved are aware of the risks that Siemens is taking with their more timely publication of vulnerabilities.

ICS-CERT Published Schneider Advisory

Today the DHS ICS-CERT published an advisory for multiple vulnerabilities in two Schneider Electric products, InduSoft WebStudio and InTouch Machine. The vulnerabilities were reported by Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies Security Lab and independent researcher Alisa Esage Shevcheckno. Schneider has produced patches for the products, but there is no indication that the researchers were provided the opportunity to verify the efficacy of the fix.

The vulnerabilities include:

∙ Hard-coded credentials - CVE-2015-0996;

∙ Authentication - CVE-2015-0997; and

∙ Clear-text transmission of sensitive information - CVE-2015-0998 and CVE-2015-0999.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to execute arbitrary code. They also mention that there may be exploits for these vulnerabilities publicly available.

Schneider published separate advisories for the two product lines (here and here). The two advisories are nearly identical and neither mention publicly available exploits. They were also both published over a month ago. There is no indication about why ICS-CERT only recently got the information.