Public ICS Disclosure – Week of 06-29-19

This week we have a vendor update for the Microsoft® RDP vulnerability and seven researcher reports (okay is should be a single report with seven vulnerabilities) from Zero Science for products from FaceSentry.

Microsoft RDP Vulnerability Vendor Reports

• Philips Update

FaceSentry Advisories

Zero Science published seven reports of vulnerabilities in the FaceSentry Access Control System. These are all zero-day reports with Zero Science reporting no response from iWT, the manufacturer.

The seven reported vulnerabilities (with proof of concept code) are:

• Cleartext transmission of sensitive information;

• Cleartext transmission of sensitive information;

• Cross-site scripting;

• Hard-coded credentials;

• OS command injection;

• Cross-site request forgery; and

• OS command injection

Public ICS Disclosures – Week of 05-25-19

This week we have three exploits for previously published vulnerabilities from Siemens, and some additional news on the Microsoft® RDP vulnerability.

Siemens Exploits

Matthias Deeg published three proof-of-concept exploits for previously reported vulnerabilities in the Siemens LOGO! 8 programmable logic controllers.

The three reported exploits are for the following reported vulnerabilities

• Missing Authentication for Critical Function - CVE-2019-10919;

• Storing Passwords in a Recoverable Format - CVE-2019-10921; and

• Use of Hard-coded Cryptographic Key - CVE-2019-10920

RDP Vulnerability

We have two additional vendor disclosures about the RDP vulnerability:

• PEPPERL+FUCHS; and

• Medtronic

Spencer has published proof-of-concept exploit code for the RDP vulnerability.

Public ICS Disclosure – Week of 05-18-19

This week we have three vendor disclosures from Eaton, Bosch and Miele. There is also one exploit report for products from Anvis. I also found more vendor information on the Microsoft® RDP  vulnerability.

Microsoft RDP Vulnerability

While the NCCIC-ICS has only released a very generic notice on the Microsoft® RDP vulnerability (CVE-2019-0708), a number of control system vendors this week have released their own outlook on the vulnerability in their products. The vendors include:

• Rockwell;

• Johnson & Johnson;

• Philips (update); and

• Siemens Healthineers:

◦ Advanced Therapy Products;

◦ Healthineers Software Products;

◦ Radiation Oncology Products;

◦ Laboratory Diagnostics Products;

◦ Radiography and Mobile X-ray Products; and

◦ Point of Care Diagnostics Products

With the number of medical device manufacturers reporting on the RDP vulnerability and the healthcare industry’s history of problems with WannaCry you would think that the FDA would have issued at least a generic warning on the issue; but no, there is nothing on the medical device safety page.

Eaton Advisory

Eaton published an advisory reporting an undescribed vulnerability in the Eaton easySoft V6. Eaton is working on a new version to mitigate the vulnerability and offers generic workarounds in the mean time.

NOTE: This has to be the worst corporate vulnerability disclosure ever. Oh well, at least an advisory was published.

Bosch Advisory

Bosch has published an advisory describing an unauthenticated certificate access vulnerability in the Bosch Video Recording Manager (VRM) software. Bosch has firmware updates that mitigate the vulnerability.

Miele Advisory

CERT-VDE has published an advisory describing two vulnerabilities in the Miele XGW 3000 ZigBee Gateway. The vulnerability was reported by Maxim Rupp. Miele has a new version that mitigates the vulnerability. There is no indication that Maxim has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper authorization; and

• Cross-site request forgery

Anvis Exploit

Wizlab-IT published an exploit for security issues with the Anvis M3 RFID Access Control product. This was a coordinated disclosure and Anvis has a new version of the device that mitigates the vulnerability.

NOTE: So all of the vulnerable devices will be replaced?????