2 Advisories and 1 Update Published – 6-15-21

Today CISA’s NCCIC-ICS published two control system security advisories for products from Automation Direct and ThroughTek. They also updated a medical device security advisory for products from OpenClinic.

Automation Direct Advisory

This advisory describes five vulnerabilities in the Automation Direct CLICK PLC CPU modules. The vulnerabilities were reported by Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans. Automation Direct has new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Authentication bypass using alternate path or channel - CVE-2021-32980, CVE-2021-32984, and CVE-2021-32986,

• Clear-text transmission of sensitive information - CVE-2021-32982, and

• Unprotected storage of credentials - CVE-2021-32978

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to log in as a currently or previously authenticated user or discover passwords for valid users.

ThroughTek Advisory

This advisory describes a clear-text transmission of sensitive information vulnerability in the ThroughTek P2P Software Development Kit (SDK). The vulnerability was reported by Nozomi Networks. ThroughTek has a new version that, along with certain setting manipulations, mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to permit unauthorized access to sensitive information, such as camera audio/video feeds.

OpenClinic Update

This update provides additional information on an advisory that was  originally published on July 2^nd, 2020 and most recently updated on August 27^th, 2020. The new information includes adding new version that mitigates the vulnerabilities.

NOTE: NCCIC-ICS forgot to refer to the previous update instead of the original version of the advisory in Section 2.

5 Advisories and 5 Updates Published – 5-27-21

Today CISA’s NCCIC-ICS published five control system security advisories for products from Mitsubishi, Siemens, Mesa Labs, Johnson Controls, and GENIVI Alliance. They also published updates for advisories for products from Mitsubishi (3) and Siemens (2).

Mitsubishi Advisory

This advisory describes an uncontrolled resource consumption vulnerability in the Mitisubishi MELSEC iQ-R series CPU. The vulnerability was reported by Younes Dragoni of Nozomi Networks. Mitisubishi provides generic workarounds to mitigate the vulenrablity.

NCCIC-ICS reports that a relatively low-skilled attacker can remotely exploit the vulnerability to prevent legitimate clients from connecting to an affected product.

Siemens Advisory

This advisory describes five vulnerabilities in the Siemens JT2Go and Teamcenter Visualization. The vulnerabilities were reported by Michael DePlante, Francis Provencher, and rgod via the Zero Day Initiative and Carsten Eiram from Risk Based Security.

The five reported vulnerabilities are:

• Out-of-bounds read (3) - CVE-2020-26998, CVE-2020-26999, and CVE-2020-27002,

• Stack-based buffer overflow - CVE-2020-27001,

• Untrusted pointer dereference - CVE-2020-26991

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to lead to arbitrary code execution or information leakage.

NOTE: I briefly discussed these vulnerabilities and the two JT2GTo updates below last Saturday.

Mesa Labs Advisory

This advisory describes five vulnerabilities in the Mesa Labs AmegaView continuous monitoring hardware and software platform. The vulnerability was reported by Stephen Yackey of Securifera. There will be no update to mitigate the vulnerabilities because the product is approaching end-of-service (end of the year).

The five reported vulnerabilities are:

• Command injection - CVE-2021-27447 and CVE-2021-27449,

• Improper authentication - CVE-2021-27451,

• Authentication bypass using an alternate path or channel - CVE-2021-27453, and

• Improper privilege management - CVE-2021-27445   

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow remote code execution or allow access to the device.

Johnson Controls Advisory

This advisory describes an off-by-one error vulnerability in the Sensormatic Electronics VideoEdge products. This is a third-party (SUDO) vulnerability with multiple published exploits (see here, here, and here for instance). The vulnerability was self-reported.

NCCIC-ICS reported that a relatively low-skilled attacker with local authenticated access could exploit this vulnerability to gain administrative access.

NOTE: This is virtually the same advisory that was published earlier this month for the Sensormatic Tyco AI. Each respective Johnson Control advisory calls the subsidiary ‘American Dynamics’ not Sensormatic.

GENIVI Advisory

This advisory describes a heap-based buffer overflow vulnerability in the GENIVI DLT-Daemon. The vulnerability was reported by Jan Schrewe of Informatik. GENIVI has a new version that mitigates the vulnerability. There is no indication that Schrewe has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to lead to remote code execution or crash the application.

Factory Automation Update #1

This update provides additional information on an advisory that was originally published on July 30^th, 2020 and most recently updated on January 14^th, 2021. The new information includes providing updated affected version information and mitigation measures for:

• EZSocket, and

• PX Developer

Factory Automation Update #2

This update provides additional information on an advisory that was originally published on July 30^th, 2020 and most recently updated on January 14^th, 2021. The new information includes providing updated affected version information and mitigation measures for MELSEC iQ-R Series Motion Module.

FA Engineering Update

This update provides additional information on an advisory that was originally published on February 18^th, 2021. The new information includes:

• Adding the following to the list of affected products:

◦ iQ Monozukuri ANDON (Data Transfer), and

◦ iQ Monozukuri Process Remote Monitoring (Data Transfer, and

• Providing updated affected version information and mitigation measures for:

◦ CPU Module Logging Configuration Tool,

◦ CW Configurator,

◦ Data Transfer,

◦ FR Configurator2,

◦ GT Designer3 Version1(GOT1000),

◦ GT Designer3 Version1(GOT2000),

◦ GT SoftGOT1000 Version3,

◦ GT SoftGOT2000 Version1,

◦ GX LogViewer,

◦ PX Developer, and

◦ RT ToolBox3

JT2Go Update #1

This update provides additional information on an advisory that was originally published on January 12^th, 2021 and most recently updated on February 9^th, 2021. The new information includes:

• Moving CVE-2020-26989, CVE-2020-26990, and CVE-2020-28383 to advisory SSA-663999, and

• Moving CVE-2020-26991 to SSA-695540

JT2Go Update #2

This update provides additional information on an advisory that was originally published on February 9^th, 2021. The new information includes:

• Removing vulnerabilities CVE-2020-26991, CVE-2020-26998, CVE-2020-26999, CVE-2020-27001, and CVE-2020-27002, and

• Adding d CVE-2020-28383 and CVE2021-31784.

15 Advisories Published – 4-13-21

Today CISA’s NCCIC-ICS published 15 control systems security advisories for products Siemens (12), JTEKT, Advantech, and Schneider Electric. One of the Siemens advisories also affects products from Milestone and another also affects products from PKE.

Milestone Advisory

This advisory describes a use of hard-coded cryptographic key in the Siemens Siveillance (Milestone) Video Open Network Bridge (ONVIF). The vulnerability was reported by Milestone PSIRT. Siemens has a hot fix and Milestone has an update to mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an authenticated remote attacker to retrieve and decrypt all user credentials stored on the ONVIF server.

Nucleus Advisory #1

This advisory describes a use of insufficiently random variables vulnerability in the Siemens Nucleus DNS module. This is one of the NAME:WRECK DNS vulnerabilities reported by Forescout and JSOF. Siemens has generic workarounds to mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to poison the DNS cache or spoof DNS resolving.

SIMOTICS Advisory

This advisory describes four vulnerabilities in the Siemens SIMOTICS CONNECT 400. The vulnerabilities were self-reported. These are NAME:WRECK vulnerabilities in the third-party Mentor DNS Module. Siemens has a new version that mitigates the vulnerabilities.

The four reported vulnerabilities are:

• Improper null termination - CVE-2020-27736,

• Out-of-bounds read - CVE-2020-27737, and

• Access of memory location after end of buffer - CVE-2020-27738 and CVE-2021-25677

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to poison the DNS cache or spoof DNS resolving.

Tecnomatix Advisory

This advisory describes an out-of-bounds write in the Siemens Tecnomatix RobotExpert. The vulnerability was reported by Francis Provencher via the Zero Day Initiative. Siemens has a new version that mitigates the vulnerability. There is no indication that Provencher has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow remote code execution.

TIM Advisory

This advisory describes 14 vulnerabilities in the Siemens TIM 4R-IE. This is a third-party vulnerability (ntp.d in SNTP). The vulnerabilities are self-reported.

The 14 reported vulnerabilities are:

• Incorrect type conversion or cast - CVE-2015-5219,

• Improper input validation (4) - CVE-2015-7855 (exploit), CVE-2015-7705, CVE-2015-8138, and CVE-2016-1547,

• Improper authentication (2) - CVE-2015-7871 and CVE-2016-4953

• Security features - CVE-2015-7973,

• Null pointer dereference - CVE-2015-7977,

• Data processing errors (2) - CVE-2015-7979 and CVE-2016-1548,

• Exposure of sensitive information to an unauthorized actor - CVE-2016-1550, and

• Race condition - CVE-2016-4954

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to compromise the confidentiality, integrity, and availability of the device.

PKE Advisory

This advisory describes twelve vulnerabilities in the Siemens (and PKE) Control Center Server (CCS). The vulnerabilities were reported by Raphaël Rigo of Airbus Security Lab. Siemens (and PKE) has new versions that mitigate the vulnerabilities. There is no indication that Rigo has been provided an opportunity to verify the efficacy of the fix.

The 12 reported vulnerabilities are:

• Cleartext storage of sensitive information in GUI - CVE-2019-13947,

• Improper authentication (2) - CVE-2019-18337 and CVE-2019-18341

• Relative path traversal - CVE-2019-18338,

• Use of a broken or risky cryptographic algorithm - CVE-2019-18340,

• Exposed dangerous method or function - CVE-2019-18342,

• Path traversal - CVE-2019-19290,

• Cleartext storage in a file or on a disk - CVE-2019-19291,

• SQL Injection - CVE-2019-19292,

• Cross-site scripting (2) - CVE-2019-19293 and CVE-2019-19294, and

• Insufficient logging - CVE-2019-19295

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to read and write arbitrary files and sensitive data and execute commands and arbitrary code.

NOTE: These vulnerabilities were removed from earlier Siemens Advisories, SSA-761617 and SSA-844761.

LOGO! Advisory

This advisory describes two vulnerabilities in the Siemens LOGO! engineering software products. The vulnerabilities were reported by Mashav Sapir from Claroty. Siemens provides generic workarounds to mitigate the vulnerabilities.

The two reported vulnerabilities are:

• Path traversal - CVE-2020-25243, and

• Uncontrolled search path element - CVE-2020-25244

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow a local attacker to take over the system where the software is installed.

NOTE: Someone slipped up on the listing of ‘Equipment’ and ‘Vulnerability’ in the ‘Executive Summary’ section of the advisory.

SINEMA Advisory

This advisory describes two vulnerabilities in the Siemens SINEMA Remote Connect Server. These are third-party vulnerabilities (libxml2). Siemens has a new version that mitigates the vulnerabilities.

The two reported vulnerabilities are:

• Missing release of resource after effective lifetime - CVE-2019-19956, and

• Infinite loop - CVE-2020-7595

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to cause a memory leak or an infinite loop situation resulting in a denial-of-service condition.

SCALANCE Advisory

This advisory describes two vulnerabilities in the Siemens Web Server of SCALANCE X200. The vulnerabilities are self-reported. Siemens has a new version that mitigates the vulnerabilities.

The two reported vulnerabilities are:

• Heap-based buffer overflow - CVE-2021-25668, and

• Stack-based buffer overflow - CVE-2021-25669

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to cause a buffer overflow condition resulting in remote code execution.

Solid Edge Advisory

This advisory describes five vulnerabilities in the Siemens Solid Edge software tools. The vulnerabilities were reported by Francis Provencher and rgod via ZDI. Siemens has updates that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Out-of-bounds write - CVE-2020-28385, CVE-2021-25678, CVE-2021-27380,

• Untrusted pointer dereference - CVE-2020-26997, and

• Stack-based buffer overflow - CVE-2021-27382

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerabilities to lead to a crash, arbitrary code execution, or data extraction on the target host system.

Nucleus Advisory #2

This advisory describes two infinite loop vulnerabilities in the Siemens Nucleus products. The vulnerabilities were self-reported. Siemens has a new version for one of the affected products that mitigates the vulnerabilities.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to cause a denial-of-service condition.

Nucleus Advisory #3

This advisory describes two vulnerabilities in the Siemens Nucleus DNS module. These are two of the NAME:WRECK DNS vulnerabilities reported by Forescout and JSOF. Siemens provides generic work arounds to mitigate the vulnerabilities.

The two reported vulnerabilities are:

• Out-of-bounds write - CVE-2020-15795, and

• Use of out-of-range pointer offset - CVE-2020-27009

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow a denial-of-service condition or for the execution of code remotely.

NOTE: There were two additional Siemens’ advisories published today that were not covered by NCCIC-ICS. If they are not covered on Thursday, I will address them on Saturday.

JTEKT Advisory

This advisory describes an improper resource shutdown or release vulnerability in the JTEKT TOYOPUC products. The vulnerability was reported by Younes Dragoni from Nozomi Networks. JTEKT has provided generic mitigation measures.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthorized user to stop Ethernet communications between devices from being established.

Advantech Advisory

This advisory describes an incorrect permission assignment for critical resources in the Advantech WebAccess/SCADA. The vulnerability was reported by Chizuru Toyama of TXOne IoT/ICS Security Research Labs of Trend Micro. Advantech has a new version that mitigates the vulnerability. There is no indication that Toyama has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to login as an ‘admin’ to fully control the system.

Schneider Advisory

This advisory describes an improper restriction of XML external entity reference vulnerability in the Schneider SoMachine Basic products. The vulnerability was reported by Gjoko Krstikj of Applied Risk. Schneider has a new product that replaces the affected product and has updated the mitigation measures.

NOTE 1: This is actually based upon an update to a Schneider advisory that was published on May 22^nd, 2018.

NOTE 2: Schneider also published two advisories and two other updates today. If they are not covered by NCCIC-ICS on Thursday, I will address them here on Saturday.

3 Advisories Published – 1-19-21

Today CISA’s NCCIC-ICS published two control system security advisories for products from Reolink and Simon Kelley, and one medical device security advisory for products from Philips.

Reolink Advisory

This advisory describes two vulnerabilities in the Reolink P2P protocol. The vulnerabilities were reported by Nozomi Networks. Reolink has a firmware upgrade that mitigates some of the risk.

The two reported vulnerabilities are:

• Use of hard-coded cryptographic key - CVE-2020-25173, and

• Ceartext transmission of sensitive information - CVE-2020-25169

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to  permit unauthorized access to sensitive information.

Dnsmasq Advisory

This advisory describes seven vulnerabilities in the Dnsmasq maintained by Simon Kelley. The vulnerabilities were reported by JSOF Tech (named DNSpooq by JSOF). Kelley has a new version that mitigates the vulnerabilities. The JSOF report confirms that the new version adequately mitigates the vulnerabilities.

The seven reported vulnerabilities are:

• Heap-based buffer overflow (4) - CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, and CVE-2020-25687,

• Insufficient verification of data authenticity (2) - CVE-2020-25684 and CVE-2020-25686, and

• Use of a broken or risky cryptographic algorithm - CVE-2020-25685,

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to result in cache poisoning, remote code execution, and a denial-of-service condition.

NOTE: The JSOF report makes it clear that there will almost certainly a number of ICS vendors that will be affected by this set of DNS vulnerabilities. At least one vendor has already reported this vulnerability in some of their products, more will be coming.

Philips Advisory

This advisory describes an OS command injection vulnerability in the Philips Haswell workstations. The vulnerability was self-reported. Philips has a patch that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit this vulnerability to remotely shut down or restart the workstation.

5 Advisories Published – 7-30-20

Today the CISA NCCIC-ICS published four control system security advisories for products from Mitsubishi Electric (3) and Inductive Automation. They also published a medical device security advisory for products from Philips.

 

Factory Automation Advisory #1

 

This advisory describes an unquoted search path or element vulnerability in the Mitsubishi Factory Automation Engineering products. The vulnerability was reported by Mashav Sapir of Claroty. Mitsubishi has new versions that mitigate the vulnerability. There is no indication that Sapir has been provided an opportunity to verify the efficacy of the fix.

 

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to obtain unauthorized information, modify information, and cause a denial-of-service condition.

 

Factory Automation Advisory #2

 

This advisory describes a path traversal vulnerability in the Mitsubishi Factory Automation products. The vulnerability was reported by Mashav Sapir of Claroty. Mitsubishi has new versions that mitigate the vulnerability. There is no indication that Sapir has been provided an opportunity to verify the efficacy of the fix.

 

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to may allow an attacker to obtain unauthorized information, tamper the information, and cause a denial-of-service condition.

 

Factory Automation Advisory #3

 

This advisory describes a permissions issue vulnerability in the Mitsubishi Factory Automation Engineering Software products. The vulnerability was reported by Younes Dragoni of Nozomi Networks, the Applied Risk research team, and Mashav Sapir of Claroty. Mitsubishi has new versions that mitigate the vulnerability. There is no indication that researchers have been provided an opportunity to verify the efficacy of the fix.

 

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to enable the reading of arbitrary files, cause a denial-of-service condition, and allow execution of a malicious binary.

 

Inductive Automation Advisory

 

This advisory describes a missing authorization vulnerability in the Inductive Automation Ignition 8 product. The vulnerability was reported by Mashav Sapir of Claroty. Inductive Automation has a new version that mitigates the vulnerability. There is no indication that Sapir has been provided an opportunity to verify the efficacy of the fxi.

 

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to gain access to sensitive information.

 

Philips Advisory

 

This advisory describes an insertion of sensitive information into log file vulnerability in the Philips DreamMapper mobile application. The vulnerability was reported by Lutz Weimann, Tim Hirschberg, Issam Hbib, and Florian Mommertz of SRC Security Research & Consulting. Philips plans a new release to mitigate the vulnerability by June of next year.

 

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker access to the log file information containing descriptive error messages.

Public ICS Disclosure – Week of 12-07-19

This week we have vendor disclosures from Siemens, Schneider (4) and Red Lion as well as advisory updates from Siemens (2) and Schneider. We also have security researcher reports for products from Advantech (2) and Schneider. And finally, we have an exploit published for products from Omron.

Siemens Advisory

Siemens published an advisory describing 53 vulnerabilities in their SPPA-T3000 servers. Vulnerabilities were reported by Gleb Gritsai, Eugenie Potseluevskaya, Sergey Andreev, and Radu Motspan from Kaspersky Lab; Vyacheslav Moskvin and Ivan B from Positive Technologies; and Can Demirel from Biznet Bilisim. Siemens has a new service pack for one of the affected servers that addresses a very limited number (3) of the applicable vulnerabilities. There is no indication that any of the researchers have been provided an opportunity to verify the efficacy of the fix.

NOTE 1: This is the advisory discussed in the TWITTER® thread I mentioned earlier this week.

NOTE: The first vulnerability reported in the advisory (CVE-2018-4832) was previously reported in other Siemens products. Siemens has not yet provided updates for all of those affected products and this is not one of the vulnerabilities remediated in this advisory.

Siemens Updates

Siemens published an update for an advisory that was originally published on November 12^th, 2019. The new information includes:

• Added SIMATIC S7-200 SMART to the list of affected devices; and

• SIPLUS devices now explicitly mentioned in the list of affected products

NOTE: NCCIC-ICS did publish an update for their advisory on this vulnerability on Tuesday, but somehow I overlooked it in my blog post.

Siemens published an update for an advisory that was originally published on July 9^th, 2019. The new information includes:

• Updates for SIMATIC IPC2X7E, SIMATIC IPC327E, SIMATIC IPC377E; and

• SIPLUS devices now explicitly mentioned in the list of affected products

Schneider Advisories

Schneider published an advisory describing three improper check for unusual or exception condition vulnerabilities in their Modicon Controllers. The vulnerabilities were reported by Younes Dragoni (Nozomi Networks), Chansim Deng, Mengmeng Young and Gideon Guo. Schneider has new firmware versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing an improper authorization vulnerability in their EcoStruxure™ Control Expert. The vulnerability was reported by Rongkuan Ma, Xin Che and Peng Cheng (Zhejiang University). Schneider has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing a stack-based buffer overflow vulnerability in their Power SCADA Operation product. The vulnerability is self-reported. Schneider has a new version that mitigates the vulnerability.

Schneider published an advisory describing a permissions, privileges and access control vulnerability in their EcoStruxure Geo SCADA Expert (ClearSCADA). The vulnerability was reported by William Knowles (Lancaster University). Schneider has a new version that mitigates the vulnerability. There is no indication that Knowles has been provided an opportunity to verify the efficacy of the fix.

NOTE: Earlier this week there had been a fifth advisory listed on the Schneider security notifications site for their Saitel DP (866e) and Saitel DR (HUe) products, but that advisory has since been removed from the list.

Red Lion Advisory

Red Lion published an advisory describing the URGENT/11 vulnerabilities in their NT24k Switch Series. The vulnerability is self-reported. Red Lion has a firmware upgrade the implements the Wind River patch.

Advantech Researher Reports

Mat Powell from the Zero Day Initiative published a report of a zero-day stack-based buffer overflow vulnerability in the Advantech Web Access product. The vulnerability has been coordinated through NCCIC-ICS. Advantech apparently reported that the vulnerability is in a third-party component but has not shared with NCCIC-ICS whom that third-party is. I do not know why NCCIC-ICS has not yet released an advisory on this vulnerability.

Tenable published a report [corrected bad link - 22:10 EDT 3-26-20] describing a stack-based buffer overflow vulnerability in the Advantech Web Access product. Advantech has a new version that Tenable has confirmed mitigates the vulnerability. The Tenable report includes exploit code.

NOTE: The two reports both describe stack-based buffer overflows, but in different components of the product (BwOpcBs.exe in the ZDI report; BwPAlarm.dll in the Tenable report)

Schneider Researcher Report

Applied Risk published a report describing an insecure file permissions vulnerability in the Schneider ClearScada product. This is probably the same vulnerability as described in the Schneider ExoStruxure advisory above as William Knowles is associated with both reports.

Omron Exploit

NOBODY published an exploit for an unrestricted externally accessible lock vulnerability in the Omron CJ2M PLC. This appears to be the same vulnerability that was reported this week.

1 Alert, 3 Advisories and 4 Updates Published – 08-13-19

Today the DHS NCCIC-ICS published a control system security alert for products from Mitsubishi Electric; three control system security advisories for products from Siemens, OSIsoft, and Delta Industrial; and four control system advisory updates for products from Siemens.

Mitsubishi Alert

This alert describes a report of seven vulnerabilities in the Mitsubishi smartRTU and INEA ME-RTU. The vulnerabilities were reported (with exploit code) by Mark Cross (@xerubus) (NCCIC-ICS did provide the link to the report, a first). Cross disclosed the vulnerabilities to CISA and published the public disclosure under the 45-day disclosure policy.

The seven reported vulnerabilities are:

• OS command injection - CVE-2019-14931;

• Unauthenticated download of configuration file - CVE-2019-14927;

• Stored cross-site script - CVE-2019-14928;

• Use of hard-coded cryptographic keys - CVE-2019-14926;

• Hard-coded user passwords - CVE-2019-14930;

• Plaintext password storage - CVE-2019-14929; and

• Incorrect default permissions - CVE-2019-14925

Siemens Advisory

This advisory describes an uncontrolled resource consumption vulnerability in the Siemens SCALANCE X switches. The vulnerability was reported by Younes Dragoni from Nozomi Networks. Siemens has provided generic workarounds. There is no indication that Dragoni has been provided an opportunity to verity the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition.

OSIsoft Advisory

This advisory describes two vulnerabilities in the OSIsoft PI Web API. The vulnerabilities are self-reported. OSIsoft has an update to mitigate the vulnerability.

The two reported vulnerabilities are:

• Inclusion of sensitive information in log files - CVE-2019-13515; and

• Protection mechanism failure.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerabilities to allow direct attacks against the product and disclose sensitive information.

Delta Advisory

This advisory describes two vulnerabilities in the Delta DOPSoft Human Machine Interface (HMI) editing software. The vulnerability was reported by kimiya of 9SG Security Team via the Zero Day Initiative. Delta has a new version that mitigates the vulnerabilities. There is no indication that kimiya has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Out-of-bounds read - CVE-2019-13513; and

• Use after free - CVE-2019-13514

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow information disclosure, remote code execution, or crash of the application.

SIMATIC WinCC Update

This update provides additional information on an advisory that was originally reported on July 11^th, 2019. The update provides new affected version information and mitigation links for:

• SIMATIC WinCC V7.3;

• SIMATIC PCS 7 V8.1, and

• SIMATIC WinCC Runtime Professional V14

Spectrum Power Update

This update provides additional information on an advisory that was originally reported on July 9^th, 2019. The update provides corrected version information for Spectrum Power 5.

SIPROTEC Update

This update provides additional information on an advisory that was originally reported on July 9^th, 2019. The update provides additional mitigation information.

SIMATIC PCS7 Update

This update provides additional information on an advisory that was originally reported on July 9^th, 2019. The update provides corrected version information and mitigation links for:

• SIMATIC WinCC V7.3; and

• SIMATIC PCS 7 V8.1

NOTE: Siemens published an additional two advisories and two updates today that were not reported by NCCIC-ICS. They may be reported on Thursday, if not, I will report on them on Saturday.

Two Advisories Published – 05-21-19

Today the DHS NCCIC-ICS published two control system security advisories for products from Mitsubishi Electric and Computrols.

Mitsubishi Advisory

This advisory describes an uncontrolled resource consumption vulnerability in the Mitsubishi MELSEC-Q series Ethernet module. The vulnerability was reported by Younes Dragoni and Alessandro Di Pinto of Nozomi Networks. Mitsubishi has a new firmware version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to render the device unresponsive, requiring a physical reset of the PLC (Programmable Logic Controller).

Computrols Advisory

This advisory describes nine vulnerabilities in the Computrols CBAS Web, a Web Building Management System (BMS). The vulnerabilities were reported by Gjoko Krstic of Applied Risk. Computrols has new firmware versions that mitigate the vulnerabilities. There is no indication that Krstic has been provided an opportunity to verify the efficacy of the fix.

The nine reported vulnerabilities are:

• Cross-site request forgery - CVE-2019-10847;

• Information exposure through discrepancy - CVE-2019-10848;

• Cross-site scripting - CVE-2019-10846;

• Command injection - CVE-2019-10854;

• Information exposure through source code - CVE-2019-10849;

• Hard-coded encryption key - CVE-2019-10851;

• SQL injection - CVE-2019-10852;

• Authentication bypass using alternate path or channel - CVE-2019-10853; and

• Inadequate encryption strength - CVE-2019-10855

NOTE: the Applied Risk report and the Computrols advisory also include an additional vulnerability; default credentials - CVE-2019-10850.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow unauthorized actions with administrative privileges, disclosure of sensitive information, execution of code within a user’s browser, execution of unauthorized OS commands, unauthorized access to the database, execution of unauthorized SQL commands, authentication bypass, or decryption of passwords.

NOTE: I briefly discussed these vulnerabilities on Saturday.

Two Advisories Published – 04-30-19

Yesterday the DHS NCCIC-ICS published a control system security advisory for products from Rockwell and a medical device security advisory for products from Philips.

Rockwell Advisory

This advisory describes two vulnerabilities in the Rockwell CompactLogix 5370 programmable automation controllers. The vulnerabilities were reported by Younes Dragoni of Nozomi Networks and George Lashenko of CyberX respectively. Rockwell has firmware updates to mitigate the vulnerabilities. There is no indication that either researcher was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Uncontrolled resource consumption - CVE-2019-10952; and

• Stack-based buffer overflow - CVE-2019-10954

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow a remote attacker to render the web server unavailable and/or place the controller in a major non-recoverable faulted state (MNRF).

Philips Advisory

This advisory describes a cross-site scripting vulnerability in the Philips Tasy EMR workflow based information system. The vulnerability was reported by Rafael Honorato. Phillips has provided generic workarounds to mitigate the vulnerability. There in no indication that Honorato has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with site or VPN access could exploit the vulnerability to provide unexpected input into the application, execute arbitrary code, alter the intended control flow of the system, and access sensitive information.

8 Advisories and 5 Updates (all Siemens) Published

Yesterday the DHS NCCIC-ICS published eight control system security advisories and updated five previously published advisories; all for products from Siemens.

SIMATIC Panels Advisory

This advisory describes two vulnerabilities in the Siemens SIMATIC HMI and WinCC. The vulnerabilities were reported by Hosni Tounsi from Carthage Red Team. Siemens has newer versions that mitigate the vulnerability. There is no indication that Tounsi has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Path traversal - CVE-2018-13812; and

• Open redirect - CVE-2018-13813

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow download of arbitrary files from the device, or allow URL redirections to untrusted websites.

SIMATIC IT Advisory

This advisory describes an improper authentication vulnerability in the Siemens SIMATIC IT Production Suite. The vulnerability is self-reported. Siemens has updated to mitigate the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow an attacker to compromise confidentiality, integrity and availability of the system.

SIMATIC Step 7 Advisory

This advisory describes an unprotected storage of credential in the Siemens SIMATIC STEP 7 (TIA Portal). This vulnerability is self-reported. Siemens has updates available that mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to reconstruct passwords.

SIMATIC S7 Advisory

This advisory describes a resource exhaustion vulnerability in the Siemens SIMATIC S7. The vulnerability was reported by Younes Dragoni of Nozomi Networks. Siemens has a new version for the S7-1500 that mitigates the vulnerability. There is no indication that Dragoni was provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition that could result in a loss of availability of the affected device.

SCALANCE S Advisory

This advisory describes a cross-site scripting vulnerability in the Siemens SCALANCE S firewalls. The vulnerability was reported by Nelson Berg of Applied Risk. Siemens has a new version that mitigates the vulnerability. There is no indication that Berg has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker using social engineering could remotely exploit this vulnerability to allow arbitrary script injection (XSS).

SIMATIC WinCC Advisory

This advisory describes a code injection vulnerability in the Siemens SIMATIC Panels and SIMATIC WinCC (TIA Portal). The vulnerability is self-reported. Siemens has updates available for all but one of the affected devices.

NCCIC reports that a relatively low-skilled attacker with network access could exploit the vulnerability to perform a HTTP header injection attack.

S7-400 Advisory

This advisory describes two improper input validation vulnerabilities in the Siemens S7-400 CPUs. The vulnerability was reported by CNCERT/CC. Siemens has provided specific workarounds to mitigate the vulnerabilities.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to crash the device being accessed which may require a manual reboot or firmware re-image to bring the system back to normal operation.

IEC 61850 Advisory

This advisory describes an improper access control vulnerability in the Siemens IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC. The vulnerability is self-reported. Siemens has updates to mitigate the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to exfiltrate limited data from the system or execute code with operating system user permissions.

Industrial Products Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th, February 27^th, 2018, May 3^rd, 2018 May 15^th, 2018, September 11^th, 2018 and most recently on October 9^th, 2018. The update provides new affected version and mitigation information for:

• SINAMICS S120;

• PN/PN Coupler;

• SIMATIC ET200 SP;

• SIMATIC S7-400 V; and

• SIMOCODE pro V PROFINET

SCALANCE Update

This update provides additional information on an advisory that was originally published on November 14^th, 2017 and updated on December 5^th, 2017, December 19^th, 2017, January 25^th, 2018 and again on April 24^th, 2018. The update changed the update information for SCALANCE W-700 (IEEE 802.11n).

PROFINET Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th,  November 28^th, 2017, January 18^th, 2018, January 25^th, 2018, January 27^th, 2018, March 6^th, 2018 and most recently on May 3^rd, 2018. The update provides new affected version and mitigation information for:

• SINAMICS S120;

• SIMATIC ET 200SP (except IM155-6 PN ST); and

• SIMATIC Panels

OpenSSL Update

This update provides additional information on an advisory that was originally published on August 14^th, 2018 and updated on September 11^th, 2018 and again on October 9^th, 2018. The update provides new affected version and mitigation information for:

• SIMATIC HMI WinCC Flexible; and

• SIMATIC IPC DiagMonitor

SIMATIC S7 Update

This update provides additional information on an advisory that was originally published on March 29^th, 2018 and updated on April 24^th, 2018, and again on June 12^th, 2018. The update provides new affected version and migitagion information for:

• SIMATIC BATCH V8.2;

• OpenPCS 7 V8.2; and

• SIMATIC Route Control V8.2

NOTE: I will address the other four updates that Siemens published on Saturday.

ICS-CERT Publishes 3 Advisories

Yesterday the DHS ICS-CERT published two control system security advisories for products from Tridium and Emerson and a medical device security advisory for products from Philips. The Tridium advisory was previously published on the HSIN ICS-CERT library on July 10, 2018. For more on this HSIN resource see the final section below.

Tridium Advisory

This advisory describes two vulnerabilities in the Tridium Niagara controller. The vulnerabilities were reported by Johnathan Gains and Leet Cyber Security. Tridium has updates available that mitigate the vulnerability. There is no indication that that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Path traversal - CVE-2017-16744; and

• Improper authentications - CVE-2017-16748

ICS-CERT reports that an uncharacterized attacker could remotely exploit these vulnerabilities to crash the device being accessed; a buffer overflow condition may allow remote code execution.

Emerson Advisory

This advisory describes four vulnerabilities in the Emerson DeltaV DCS Workstations. The vulnerabilities were reported by Younes Dragoni of Nozomi Networks, Ori Perez of CyberX. Emerson has a patch available that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Uncontrolled search path element - CVE-2018-14797;

• Relative path traversal - CVE-2018-14795;

• Improper privilege management - CVE-2018-14791; and

• Stack-based buffer overflow - CVE-2018-14793

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow arbitrary code execution, malware injection, or malware to spread to other workstations.

Philips Advisory

This advisory describes two vulnerabilities in the Philips PageWriter Cardiographs. Philips is self-reporting these vulnerabilities to ICS-CERT. Philips has produced generic workarounds and plans to issue updates to mitigate the vulnerabilities in the middle of next year.

The two reported vulnerabilities are:

• Improper input validation - CVE-2018-14799; and

• Use of hard-coded credentials - CVE-2018-14801

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to allow buffer overflows or allow an attacker to access and modify settings on the device.

HSIN Library

It has been a while since I mentioned the ICS-CERT library on the Homeland Security Information Network. This restricted access, on-line resource provides ICS-CERT a method of sharing information with the user community for vulnerabilities that may affect critical homeland resources. This restricted release is designed to allow owners a chance to implement mitigation measures before the vulnerability becomes public knowledge.

For more information about this program and to request access see this ICS-CERT page.

Public ICS Disclosures – Week of 08-04-18

This week we have four vendor advisories from Siemens (3) and ABB and an update of a vendor advisory from Siemens. There were also a number of BlackHat Briefings this week that touched on control system security issues.

Automation License Manager Advisory

Siemens reported two vulnerabilities in their Automation License Manager. The vulnerabilities were reported by Vladimir Dashchenko from Kaspersky Lab. Siemens has updates available to mitigate the vulnerabilities. There is no indication that Dashchenko was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Directory traversal - CVE-2018-11455; and

• Network canning vulnerability - CVE-2018-11456

OpenSSL Advisory

Siemens reported an ‘open error state’ vulnerability in the OpenSSL implementation in a number of Siemens Industrial Products. This third-party software vulnerability is being self-reported by Siemens. Siemens has developed updates for some of the affected products (additional work is ongoing) to mitigate the vulnerability.

As always with third-party software issues, there is always the possibility that this vulnerability may affect control system products from other vendors.

SIMATIC Advisory

Siemens reported two improper file permission vulnerabilities in their SIMATIC Step 7 and WinCC products. The vulnerabilities were reported by Younes Dragoni from Nozomi Networks. Siemens has updates for some of the affected products and has reported work arounds.

NOTE: Siemens notes that this vulnerability was coordinated through ICS-CERT so we will probably see this reported by ICS-CERT next week.

ABB Advisory

ABB reported (registration required) an  LDAP authentication vulnerability in their eSOMS product. The vulnerability was reported by an undisclosed researcher. ABB is working on a new version to mitigate the vulnerability and has reported a work around.

Siemens Update

Siemens updated their Spectre/Meltdown advisory. This advisory was last updated on June 26^th, 2018. This latest update adds update information for SIMATIC IPC6x7C, SIMAITC IPC8x7C, SIMOTION P320-4S, and SIMOTION P320-4E.

BlackHat Briefings

The latest BlackHat conference was held in Las Vegas this week. There were six briefings that the conference web site identifies as touching on Smart Grid/Industrial Security. There were:

TRITON: How it Disrupted Safety Systems and Changed the Threat Landscape of Industrial Control Systems, Forever

Speaker: Andrea Carcano, Marina Krotofil, Younes Dragoni

White Paper - http://i.blackhat.com/us-18/Wed-August-8/us-18-Carcano-TRITON-How-It-Disrupted-Safety-Systems-And-Changed-The-Threat-Landscape-Of-Industrial-Control-Systems-Forever-wp.pdf

Deep Dive into an ICS Firewall, Looking for the Fire Hole

Speaker: Benoit Camredon, Julien Lenoir

Breaking the IIoT: Hacking industrial Control Gateways

Speaker: Thomas Roth

Snooping on Cellular Gateways and Their Critical Role in ICS

Speaker: Justin Shattuck

Presentation Slides - http://i.blackhat.com/us-18/Thu-August-9/us-18-Shattuck-Snooping-on-Cellular-Gateways-and-Their-Critical-Role-in-ICS.pdf

Outsmarting the Smart City

Speaker: Daniel Crowley, Jennifer Savage, Mauro Paredes

White Paper - http://i.blackhat.com/us-18/Thu-August-9/us-18-Crowley-Outsmarting-The-Smart-City-wp.pdf

SirenJack: Cracking a 'Secure' Emergency Warning Siren System

Speaker: Balint Seeber

ICS-CERT Publishes 4 Advisories and 2 Siemens Updates

Today the DHS ICS-CERT published three control system security advisories for products from Delta Electronics, Siemens, Phoenix Contact, and Medtronic. They published on medical device security advisory for products from Medtronic. They also updated two previously issued control system security advisories for products from Siemens.

The three Siemens advisories/updates are the ones I mentioned in passing earlier this week.

Delta Advisory

This advisory describes a heap-based buffer overflow vulnerability in the Delta Industrial Automation TPEditor. The vulnerability was reported by ThePotato working with ZDI. Delta has released a new version that mitigates the vulnerability. There is no indication that the researcher was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to crash the accessed device, resulting in a buffer overflow condition that may allow remote code execution.

Siemens Advisory

This advisory describes an improper input validation vulnerability in the Siemens S7-400 CPU. The vulnerability is being self-reported. Siemens has updates that mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition of the CPU. The CPU will remain in DEFECT mode until a manual restart is performed. The Siemens security advisory notes that:

“Successful exploitation requires an attacker to be able to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security vulnerability”

Phoenix Contact Advisory

This advisory describes four vulnerabilities in the Phoenix FL SWITCH 3xxx/4xxx/48xx Series. The vulnerabilities were reported by  Vyacheslav Moskvin, Semen Sokolov, Evgeniy Druzhinin, Georgy Zaytsev and Ilya Karpov of Positive Technologies working through CERT@VDE. Newer firmware mitigates the vulnerability. There is no indication that any of the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Command injection - CVE-2018-10730;

• Information exposure - CVE-2018-10729; and

• Stack-based buffer overflow (2) - CVE-2018-10728, and CVE-2018-10731

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow for remote code execution and information disclosure.

GE Advisory

This advisory describes an improper input validation vulnerability n the GE PACSystems, an industrial Internet controller. The vulnerability was reported by Younes Dragoni of Nozomi Networks. GE has released new firmware to mitigate the vulnerability. There is no indication that Dragoni was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause the device to reboot and change its state, causing the device to become unavailable.

Medtronic Advisory

This advisory describes a missing encryption of sensitive data vulnerability in the Medtronic N’Vision Clinician Programmer. The vulnerability was reported by Billy Rios of Whitescope LLC. Medtronic has mitigated the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker with physical access to the card could exploit the vulnerability to access personal health information (PHI) or personally identifiable information (PII).

NOTE: This vulnerability was not reported on the FDA Medical Device Safety Communications page.

SIPROTEC Update #1

This update provides additional information on an advisory that was originally reported by ICS-CERT on May 19th, 2016 and updated on July 5^th, 2016. This update removes 7SD80 from list of affected products.

SIPROTEC Update #2

This update provides additional information on an advisory that was was originally published on March 8^th, 2018 and updated on April 19^th, 2018. This update provides updated effected version information and mitigation measures for 7SD80.