Public ICS Disclosures – Week of 1-25-20

This week we have vendor disclosures from Bosch (4), Schneider, GE and BD. There are also one updated disclosure from Rockwell. Finally, we have two researcher disclosures for products from Eaton and KMC Controls.

Bosch Advisories

Bosch published an advisory describing a deserialization of untrusted data vulnerability in their BVMS Mobile Video Service (BVMS MVS). The vulnerability is self-reported. Bosch has a new version that mitigates the vulnerability.

Bosch published an advisory describing an missing authentication for a critical function vulnerability in their Video Streaming Gateway (VSG). The vulnerability is self-reported. Bosch has a new version that mitigates the vulnerability.

Bosch published an advisory describing a path traversal vulnerability in their BVMS NoTouch deployment. Bosch has a new version that mitigates the vulnerability.

Bosch published an advisory describing a path traversal vulnerability in their Bosch Video Management System (BVMS). The vulnerability is self-reported. Bosch has a new version that mitigates the vulnerability.

Schneider Advisory

Schneider published an advisory describing two vulnerabilities in their EcoStruxure™ Operator

Terminal Expert software. The vulnerabilities were discovered during the Pwn2Own event at the S4x20. Schneider is investigating the vulnerabilities.

NOTE: The rules for the competition prevent public disclosure of the vulnerabilities for 120-days after the event. Schneider is being very proactive about publicly disclosing these 0-day vulnerabilities this early.

The two reported vulnerabilities are:

• An arbitrary DLL loading issue; and

• A path traversal issue

GE Advisory

GE published an advisory describing the effects of the Ekans ransomware on GE’s Proficy products as well as a GE licensing service. They note that: “No known GE Digital product vulnerability is being targeted by EKANS ransomware.”

BD Advisory

BD published an advisory for the Windows CryptoAPI vulnerability in their products. This preliminary advisory provides a list of their products utilize Windows 10, Windows Server 2016, and Windows Server 2019 and may thus be affected by the vulnerability.

Rockwell Update

Rockwell published an update to their Windows CryptoAPI advisory. Rockwell reports that they have successfully qualified the Microsoft patch for the vulnerability.

Eaton Disclosure

Skull Army published a report describing a cross-site scripting vulnerability in the Eaton 5P 850. The report includes proof-of-concept code. There is no indication that Eaton has been informed so this may be a 0-day vulnerability.

KMC Controls Disclosure

Skull Army published a report describing a back-door vulnerability in the KMC Controls BACnet Building Controller. The report includes proof-of-concept code. There is no indication that EMC Controls has been informed so this may be a 0-day vulnerability.

NOTE: The report lists the manufacturer as “KMS Controls”, but the NIST report for the CVE lists the product as “BAC-A1616BC BACnet” and that product is from KMC Controls. I cannot find a listing for ‘KMS Controls”.

ICS-CERT Publishes Two Advisories

This afternoon the DHS ICS-CERT published two control system security advisories for products from KMC Controls and Trihedral Engineering. The KMC Controls advisory was originally published on the US CERT Secure Portal on May 5^th, 2016.

KMC Controls Advisory

This advisory describes twin vulnerabilities in the KMC Controls Conquest BACnet routers. The vulnerabilities were reported by Maxim Rupp. KMC has produced a new firmware version to mitigate the vulnerabilities. There is no indication that Rupp has been provided an opportunity to verify the efficacy of the fix.

The two vulnerabilities are:

• Cross-site request forgery - CVE-2016-4494; and

• Missing authentication for critical information - CVE-2016-4495.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerabilities to  read the configuration of the target device.

Trihedral Engineering Advisory

This advisory describes multiple vulnerabilities in the Trihedral Engineering VTScada. The vulnerabilities were reported by an anonymous researcher through the Zero Day Initiative (ZDI).

The vulnerabilities include:

• Out-of-bounds read - CVE-2016-45232F;

• Path traversal - CVE-2016-45325F; and

• Authentication bypass issues - CVE-2016-45108F.

NOTE: The CVE numbers listed above were copied directly from the advisory, but are not in the proper format. It is too early to verify the numbers in the CVE database. I suspect that the real numbers end after the first four digits following the final dash.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to download or view arbitrary files, or to cause the server to crash and not come back without being manually relaunched.

The advisory reports that the upgrade notes on the Trihedral web site provide additional help on installing the updates. Unfortunately, the firmware version that mitigates these vulnerabilities is not listed on that page. That may be because the next latest firmware version was published yesterday and the security updated version was published today.