ICS-CERT Publishes Update and 2 New Advisories

ICS-CERT Publishes an update to an N-Tron advisory published earlier this year and two new advisories for products from EasyIO and Endress+Hauser.

N-Tron Update

This update reports that Red Lion has produced a firmware update that mitigates the vulnerability and that the researcher who initially reported the vulnerability, Neil Smith, has verified the efficacy of the fix. The update reports that the update allows the end user to upload unique keys/certificates to the unit and this required a re-write of the user manual. The new manual is available here.

NOTE: This update is not on the main ICS-CERT web page so, unless you follow @ICSCERT on Twitter (or of course read this blog) you would not know about this update.

EasyIO Advisory

This advisory describes a hard-coded credential vulnerability in the EasyIO-30P-SF controller. The vulnerability was reported by Maxim Rupp. EasyIO has produced a patch that mitigates the vulnerability and Rupp has verified the efficacy of the fix. This advisory was originally released on the US-CERT Secure Portal on August 25^th and is probably one of the advisories on that Portal that I reported on earlier this month.

ICS-CERT notes that this controller is “used in a number of DDC systems worldwide”. With this in mind a supplement has been issued to this advisory that lists a number of the OEM partners (and their devices) that are affected by this vulnerability. It also lists separate actions taken by those partners to mitigate this vulnerability.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to gain complete access to the controller.

Endress+Hauser Advisory

This advisory describes an XML code injection vulnerability in Endress+Hauser Fieldcare used in conjunction with CodeWright HART Comm DTM. The vulnerability was reported by Alexander Bolshev of Digital Security. Endress+Hauser and CodeWright have each produced updates that work together to mitigate this vulnerability. Bolshev has verified the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker on an adjacent network that receives HART DTM packets could exploit this vulnerability.

Question: How many other device manufacturers have a similar problem that would interact with the CodeWright HART Comm DTM to produce the same vulnerability? I am afraid that there is nothing in this advisory that would allow anyone to answer that question with any accuracy.

ICS-CERT Publishes Two Advisories

Today the DHS ICS-CERT published two new control system advisories for systems from Sinapsi and N-Tron.

Sinapsi Advisory

This advisory describes a plain text password vulnerability in the Sinapsi eSolar Light application. The vulnerability was disclosed by Maxim Rupp. Sinapsi had produced a new version that mitigates the vulnerability but there is no indication that Rupp has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker with local system access could exploit this vulnerability to gain system passwords.

ICS-CERT reports that the updated version is available by contacting Sinapsi on their web site. ICS-CERT does not provide a link to the web site.

Interestingly an earlier ICS-CERT alert for separate Sinapsi eSolar Light vulnerabilities indicates that this product had also been sold under the names Enerpoint eSolar Light, Schneider Electric Ezylog Photovoltaic Management Server, Gavazzi Eos-Box, and Astrid Green Power Guardian. I suspect that at least some versions of those products might be affected by this vulnerability as well.

N-Tron Advisory

This advisory describes a hard-coded encryption key vulnerability in the N-Tron 702-W Industrial Wireless Access Point device. The vulnerability was reported to ICS-CERT by Neil Smith of ZeroFox. ICS-CERT reports that:

“N-Tron has been notified of this reported vulnerability, and NCCIC/ICS‑CERT has not been able to successfully coordinate this issue with N-Tron or Red Lion because of the vendor’s unresponsiveness. ICS-CERT is unaware of any fix, patch, or update by N-Tron that mitigates this vulnerability. This advisory is being published to inform critical infrastructure asset owners of the risk of using this equipment and for them to increase compensating measures if possible.”