9 Advisories Published – 9-8-20

Today the CISA NCIC-ICS published nine control system security advisories for products from Wibu-Systems and Siemens (8). The Wibu advisory was originally published with restricted access on the HSIN ICS library on July 21^st, 2020. It has been a little over 22 months since NCCIC-ICS last published an advisory on HSIN before releasing it to the general public.

NOTE: NCCIC-ICS also updated seven advisories from Siemens. I will address those in a separate blog post, probably tomorrow.

Wibu-Systems Advisory

This advisory describes six vulnerabilities in the Wibu-Systems CodeMeter. These vulnerabilities were reported by Sharon Brizinov and Tal Keren of Claroty. Wibu has a new version that, along with other specific measures mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Buffer access with incorrect length value - CVE-2020-14509,

• Inadequate encryption strength - CVE-2020-14517,

• Origin validation error - CVE-2020-14519,

• Improper input validation - CVE-2020-14513,

• Improper verification of cryptographic signature - CVE-2020-14515, and

• Improper resource shutdown or release - CVE-2020-16233

NOTE: The CVE links are to the respective Wibu advisory. They apparently publish a separate advisory for each vulnerability. These advisories provide a bit more detail than does the NCCIC-ICS advisory.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to alter and forge a license file, cause a denial-of-service condition, potentially attain remote code execution, read heap data, and prevent normal operation of third-party software dependent on the CodeMeter.

NOTE: NCCIC-ICS provided links to two vendor advisories for products affected by this vulnerability:

• Siemens, and

• Rockwell

Polarian Advisory

This advisory describes two vulnerabilities in the Siemens Polarion Subversion Webclient. The vulnerabilities were reported by Li Yifan. Siemens considers the product shareware, distributed “as is,” and will be no fix as it is no longer supported.

The two reported vulnerabilities are:

• Basic XSS - CVE-2020-15788, and

• Cross-site request forgery - CVE-2020-15789

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to to induce the victim to issue an HTTP request could lead to a state-changing operation.

Industrial Products Advisory

This advisory describes an exposure of sensitive information to an unauthorized actor vulnerabilities in the Siemens Industrial Products. The Siemens advisory notes that this is the third-party (Intel) Crosstalk vulnerability. The vulnerability was reported by Alyssa Milburn, Hany Ragab, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida from the VUSec group. Siemens is working on an update and currently only provides generic workarounds to mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker with local access could exploit this vulnerability to allow an authenticated user to enable information disclosure via local access.

SIMATIC Advisory #1

This advisory describes two vulnerabilities in the Siemens SIMATIC HMI Products. The vulnerabilities were reported by Joseph Gardiner from Bristol Cyber Security Group. Siemens is working on an update and currently only provides generic workarounds to mitigate the vulnerability.

The two reported vulnerabilities are:

• Improper restriction of excessive authentication attempts - CVE-2020-15786, and

• Authentication bypass by primary weakness - CVE-2020-15787.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.

Siveillance Advisory

This advisory describes a cleartext transmission of sensitive information vulnerability in the Siemens Siveillance Video Client IP video management software. The vulnerability is self-reported. Siemens has a new version that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to obtain valid administrator login names and use this information to launch further attacks.

Spectrum Advisory

This advisory describes two vulnerabilities in the Siemens Spectrum Power products. The vulnerabilities were reported by Can Demirel of Cyberwise. Siemens has updates that mitigate the vulnerabilities. There is no indication that Demirel has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Cleartext storage of sensitive information - CVE-2020-15784, and

• Exposure of information through directory listing - CVE-2020-15790

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerabilities to allow an unauthorized attacker to retrieve a list of software users, or in certain cases to list the contents of a directory.

License Management Advisory

This advisory describes an execution with unnecessary privileges vulnerability in the Siemens License Management Utility (LMU). The vulnerability was reported by Bundesamt für Sicherheit in der Informationstechnik (BSI). Siemens has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow local users to escalate privileges.

SIMATIC Advisory #2

This advisory describes an insufficiently protected credentials vulnerability in the Siemens SIMATIC S7-300 and S7-400 CPUs. The vulnerability was reported by Hyunguk Yoo from University of New Orleans and Irfan Ahmed and Adeen Ayub from Virginia Commonwealth University. Siemens has provided generic workarounds to mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit this vulnerability to allow credential disclosure.

SIMATIC Advisory #3

This advisory describes three vulnerabilities in the Siemens SIMATIC RTLS Locating Manager. The vulnerabilities were self-reported. Siemens has an update that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Incorrect default permissions - CVE-2020-10049 and CVE-2020-10050, and

• Unquoted search path or element -CVE-2020-10051

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to allow a privileged local user to escalate privileges.

3 Advisories and 1 Update Published – 7-28-20

Today the CISA NCCIC-ICS published three control system security advisories for products from HMS Industrial Networks, Softing Industrial, and Secomea. They also published an update for an advisory for products from Delta Industrial Automation.

HMS Advisory

This advisory describes a stack-based buffer overflow in the HMS eCatcher VPN client. The vulnerability was reported by Sharon Brizinov of Claroty. HMS has a new version that mitigates the vulnerability. There is no indication that Brizinov has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to crash the device being accessed. In addition, a buffer overflow condition may allow remote code execution with highest privileges.

NOTE: I briefly discussed this vulnerability earlier this month.

Softing Advisory

This advisory describes two vulnerabilities in the Softing OPC. The vulnerabilities were reported by Uri Katz of Claroty. Softing has a new version that mitigates the vulnerability. There is no indication that Katz has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Heap-based buffer overflow - CVE-2020-14524, and

• Uncontrolled resource consumption - CVE-2020-14522

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to crash the device being accessed. A buffer-overflow condition may also allow remote code execution.

Secomea Advisory

This advisory describes four vulnerabilities in the Secomea GateManager VPN manager. The vulnerabilities were reported by Sharon Brizinov and Tal Keren of Claroty. Secomea has a new versin that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Improper neutralization of null byte or null character - CVE-2020-14500,

• Off-by-one error - CVE-2020-14508,

• Use of hard-coded credentials - CVE-2020-14510, and

• Use of password hash with insufficient computational effort - CVE-2020-14512

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow a remote attacker to gain remote code execution on the device.

Delta Update

This update provides additional information on an advisory that was originally published on June 30^th, 2020. The new information includes a link to a new version that mitigates the vulnerabilities.

3 Advisories Published – 6-11-20

Today the CISA NCCIC-ICS published two control system security advisories for products from Rockwell Automation and OSIsoft as well as a medical device security advisory for products from Philips.

Rockwell Advisory 

This advisory describes four vulnerabilities in the Rockwell FactoryTalk Linx Software. The vulnerabilities were reported by Sharon Brizinov and Amir Preminger, of Claroty. Rockwell has patches that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Improper input validation (2) - CVE-2020-11999 and CVE-2020-12001,

• Path traversal - CVE-2020-12003, and

• Unrestricted upload of file of dangerous type - CVE-2020-12005

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to cause a denial-of-service condition, obtain remote code execution, and read sensitive information.

OSIsoft Advisory

This advisory describes a cross-site scripting vulnerability in the OSIsoft PI Web API 2019. The vulnerability was reported by Dor Yardeni and Eliad Mualem at OTORIO. OSIsoft has a new service pack that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow a remote authenticated attacker with write access to a PI Server to trick a user into interacting with a PI Web API endpoint that executes arbitrary JavaScript in the user’s browser, resulting in view, modification, or deletion of data as allowed for by the victim’s user permissions.

Philips Advisory

This advisory describes an insertion of sensitive information into log file vulnerability in the Philips  IntelliBridge Enterprise (IBE). Indiana University Health reported the vulnerability. Philips plans a new release to mitigate the vulnerability in 4^th Qtr 2020; meanwhile they provide generic mitigation measures to address the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to allow an attacker to access credentials to the hospital’s clinical information systems (EMR).

2 Advisories Published – 5-21-20

Today the CISA NCCIC-ICS published two control system security advisories for products from Schneider Electric and Johnson Controls.

Schneider Advisory

This advisory describes five vulnerabilities in the Schneider EcoStruxure Operator Terminal Expert. The vulnerabilities were reported by Sharon Brizinov and Amir Preminger of Claroty Research (via the Zero Day Initiative), Steven Seeley and Chris Anastasio of Incite Team (via ZDI), and Fredrik Østrem, Emil Sandstø, and Cim Stordal of Cognite. Schneider has an update that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• SQL Injection - CVE-2020-7493,

• Path traversal (3) - CVE-2020-7494, CVE-2020-7495 and CVE-2020-7497, and

• Argument injection - CVE-2020-7496

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could use publicly available code to exploit the vulnerabilities to allow unauthorized write access or remote code execution.

NOTE: I briefly discussed these vulnerabilities last Saturday.

Johnson Controls Advisory

This advisory describes a cleartext storage of sensitive information vulnerability in Sensormatic Electronics (subsidiary of Johnson Controls) video management systems. The vulnerability is self-reported. Johnson Controls has new versions that mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to access credentials used for access to the application.

2 Advisories Published – 5-19-20

Today the CISA NCCIC-ICS published two control system security advisories for products from Rockwell Automation and Emerson.

Rockwell Advisory

This advisory describes two vulnerabilities in the Rockwell EDS Subsystem. The vulnerabilities were reported by Sharon Brizinov and Amir Preminger (VP Research) of Claroty. Rockwell has a patch available to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper restriction of operations within the bounds of a memory buffer - CVE-2020-12038, and

• SQL injection - CVE-2020-12034

NCCIC-ICS reported that a relatively low-skilled attacker on an adjacent network could exploit the vulnerabilities to  lead to a denial-of-service condition.

Emerson Advisory

This advisory describes three vulnerabilities in the Emerson OpenEnterprise SCADA Software. The vulnerabilities were reported by Roman Lozko of Kaspersky. Emerson has an upgrade that mitigates the vulnerabilities. There is no indication that Lozko has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Missing authentication for critical function - CVE-2020-10640,

• Improper ownership management - CVE-2020-10632, and

• Inadequate encryption strength - CVE-2020-10636

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker access to OpenEnterprise configuration services or access passwords for OpenEnterprise user accounts.

Public ICS Disclosures – Week of 5-9-20

This week we have five vendor disclosures for products from Schneider (4) and Rockwell as well as six vendor updates from Schneider (5) and Siemens. We also have two researcher reports of vulnerabilities in products from Advantech.

Schneider Advisories

Schneider published an advisory describing a weak password requirement vulnerability in their Pro-face GP-Pro EX Programming Software product. The vulnerability was reported by Kirill Kruglov of Kaspersky Labs. Schneider has a new version that mitigates the vulnerability. There is no indication that Krublov has been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing a use of hard-coded credentials vulnerability in their Vijeo Designer Basic and Vijeo Designer software products. The vulnerability was reported by Jie Chen of NSFOCUS. Schneider has a HotFix available to mitigate the vulnerability. There is no indication that Jie has been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing two vulnerabilities in their U.motion servers and touch panel products. The vulnerabilities were reported by Rgod and Zhu Jiaqi. Schneider has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper access control - CVE-2020-7499, and

• SQL injection - CVE-2020-7500

Schneider published an advisory describing five vulnerabilities in their EcoStruxure™ Operator Terminal Expert product. The vulnerabilities were reported by Steven Seeley and Chris Anastasio of Incite Team, Sharon Brizinov and Amir Preminger of Claroty Research via the Zero Day Initiative (see here, here, and here), and Fredrik Østrem, Emil Sandstø, and Cim Stordal of Cognite. Schneider has a new version that mitigates four of the five vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• SQL command injection - CVE-2020-7493,

• Path traversal (3) - CVE-2020-7494, CVE-2020-7495, and CVE-2020-7497, and

• Argument injection or modification - CVE-2020-7496

Rockwell Advisory

Rockwell published an advisory describing five vulnerabilities in multiple Rockwell Automation software products. These are third-party vulnerabilities from OSIsoft components used in the Rockwell products. These vulnerabilities are self-identified. Rockwell provides workarounds to mitigate the vulnerabilities.

The five reported vulnerabilities are:

• Local privilege escalation via uncontrolled search path element - CVE-2020-10610,

• Local privilege escalation via improper verification of cryptographic key - CVE-2020-10608,

• Local privilege escalation via incorrect default permissions - CVE-2020-10606,

• Null pointer dereference - CVE-2020-10600, and

• Use of out-of-range pointer offset may lead to remote code execution - CVE-2020-10645

NOTE: These are five of the ten vulnerabilities in the OSIsoft PI System that were reported by NCCIC-ICS earlier this week. The fact that this Rockwell Advisory was published on the same day as the NCCIC-ICS advisory indicates that there was pre-disclosure coordination between OSIsoft and Rockwell, good show.

Advantech Advisories

The Zero Day Initiative published advisories (see links below) describing two vulnerabilities in Advantech WebAccess Node. ZDI published the two advisories as 0-day notifications under their 120-day response rule. NCCIC-ICS was reported involved in the coordination of these vulnerabilities. The vulnerabilities were reported by Z0mb1E.

The two reported vulnerabilities are:

• DATACORE Stack-based Buffer Overflow Remote Code Execution Vulnerability - ZDI-20-654, and

• Incorrect Permission Assignment Privilege Escalation Vulnerability - ZDI-20-655

Schneider Updates

Schneider published an update for the Urgent/11 advisory that was originally published on August 11^th, 2019 and most recently updated on April 14^th, 2020. The new information includes updated mitigation information for:

• Modicon Network Option Switch,

• Modicon X80 - I/O Drop Adapters,

• Modicon Quantum 140 CRA,

• Modicon Quantum Head 140 CRP,

• Modicon Quantum Ethernet DIO network module - 140NOC78x00 (C),

• SCD6000 Industrial RTU, and

• Pro-face HMI -GP4000H/R/E Series

Schneider published an update for their Andover Continuum System advisory that was originally published on March 10^th, 2020 and most recently updated on April 14^th, 2020. The new information includes minor updates to overview, vulnerability details, and product information for clarification.

Schneider published an update for their Embedded Web Servers for Modicon advisory that was originally published in November 2018 and most recently updated November 27^th, 2019. The new information includes a corrected CVSS vector for CVE-2018-7812.

Schneider published an update for their Modicon Controllers advisory that was originally published on May 14^th, 2019 and most recently updated on December 10^th, 2019. The new information includes updated fix version information for CVE-2018-7857.

Schneider published an update for their Legacy Triconex advisory that was originally published on April 14^th, 2020. Unfortunately, the link on the Schneider web site takes one to the original version of the advisory.

Siemens Update

Siemens published an update for their GNU/Linux advisory that was originally published on November 27^th, 2018 and most recently updated on April 14^th, 2020. The new information includes the addition of the following CVE’s:

• CVE-2019-9674,

• CVE-2019-18348,

• CVE-2019-20636,

• CVE-2020-8492,

• CVE-2020-11565,

• CVE-2020-11655, and

• CVE-2020-11656

1 Advisory Published – 4-21-20

The CISA NCCIC-ICS published a control system security advisory for products from Inductive Automation.

Inductive Advisory

This advisory describes an improper access control vulnerability in the Inductive Advisory Ignition 8 Gateway. The vulnerability was reported by Sharon Brizinov and Mashav Sapir from Claroty. Inductive has a new version that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to write endless log statements into the database, which could result in a denial-of-service condition.

5 Advisories and 1 Update Published

Today the CISA NCCIC-ICS published five control system security advisories for products from KUKA, Fuji Electric, HMS Networks, GE Digital and Advantech. They also updated an advisory for products from Synergy.

KUKA Advisory

This advisory describes an improper enforcement of message integrity in a communications channel vulnerability in the KUKA Sim Pro. The vulnerability was reported by Federico Maggi of Trend Micro. KUKA has an upgrade that mitigates the vulnerability. There is no indication that Maggi has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to result in a loss of integrity in external 3D models fetched from remote servers. When tested on real machines, this effect is unpredictable.

Fuji Advisory

This advisory describes a heap-based buffer overflow vulnerability in the Fuji V-Server Lite. The vulnerability was reported by kimiya via the Zero Day Initiative. Fuji has a new version that mitigates the vulnerability. There is no indication that kimiya has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reported that a relatively low-skilled attacker could remotely exploit the vulnerability to allow a remote attacker to gain elevated privileges for remote code execution.

HMS Advisory

This advisory describes a cross-site scripting vulnerability in the HMS eWON Flexy and Cosy. The vulnerability was reported by Ander Martínez of Titanium Industrial Security. HMS has a firmware update that mitigates the vulnerability. There is no indication that Martinez has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit this vulnerability to initiate a password change.

NOTE: I briefly discussed this vulnerability back in February.

GE Advisory

This advisory describes an improper privilege management vulnerability in the GE Digital CIMPLICITY HMI/SCADA product. The vulnerability was reported by Sharon Brizinov of Claroty. GE has a new version that mitigates the vulnerability. There is no indication that Brizinov has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an adversary to modify the systemwide CIMPLICITY configuration, leading to the arbitrary execution of code.

NOTE: I briefly discussed this vulnerability last weekend.

Advantech Advisory

This advisory describes eight vulnerabilities in the Advantech WebAccess/NMS network management system. The vulnerability was reported by rgod of 9sg via ZDI. Advantech has a new version that mitigates the vulnerability. There is no indication that rgod was provided an opportunity to verify the efficacy of the fix.

The eight reported vulnerabilities are:

• Unrestricted upload of file with dangerous type - CVE-2020-10621;

• SQL injection (2) - CVE-2020-10617 and CVE-2020-10623;

• Relative path traversal (2) - CVE-2020-10619 and CVE-2020-10631;

• Missing authentication for critical function - CVE-2020-10625;

• Improper restriction of XML external entity reference -CVE-2020-10629; and

• OS command injection - CVE-2020-10603

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to gain remote code execution, upload files, delete files, cause a denial-of-service condition, and create an admin account for the application.

Synergy Update

This update provides new information on an advisory that was originally published on February 11^th, 2020. The new information includes:

• Four new vulnerabilities:

◦ Missing authentication for critical function - CVE-2019-16879;

◦ Improper check for unusual or exceptional conditions - CVE-2020-7800;

◦ Exposure of sensitive information to an unauthorized actor - CVE-2020-7801; and

◦ Incorrect default permissions - CVE-2020-7802

• Links to three associated advisories from SSS (here, here and here)

Public ICS Disclosures – Week of 03-21-20

This week we have five vendor disclosures for products from Phoenix Contact (2), 3S (2) and Philips along with an update of a previous vendor disclosure from Belden. There is also an exploit publication for products from GE. Finally, an interesting look at control system security and COVID-19 ‘industrial distancing’.

Phoenix Contact Advisories

Phoenix Contact published an advisory [.PDF download link] describing a privilege escalation vulnerability in their Portico Remote desktop control software. The vulnerability was reported by an unnamed researcher. Phoenix Contact has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

Phoenix Contact published an advisory [.PDF download link] describing an insecure permissions vulnerability in their PC WORX SRT. The vulnerability was reported by  Sharon Brizinov of

Claroty. Phoenix Contact provides generic workarounds to mitigate the vulnerability.

3S Advisories

3S published an advisory [.PDF download link] describing an out-of-bounds memory buffer access vulnerability in their  CODESYS communication protocol. The vulnerability was reported by Carl Hurd of Cisco Talos and an OEM customer. 3S has a new version that mitigates the vulnerability. There is no indication that Hurd has been provided an opportunity to verify the efficacy of the fix.

NOTE: The Talos report includes proof-of-concept exploit code.

3S published an advisory [.PDF download link] describing a heap-based buffer overflow vulnerability in their Web Service application. The vulnerability was reported by Tenable. 3S has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

NOTE: The Tenable report includes proof-of-concept exploit code.

Philips Advisory

Philips published an advisory describing two vulnerabilities in their AC 2719 Air Purifier when using the Air Matters Android application. Philips reports that this is a chip-level problem, but reportedly a newer version of the application mitigates the vulnerabilities (?). The vulnerabilities were reported by an unnamed researcher.

The two (3 or 4 depending on where you read in the advisory) reported vulnerabilities are:

• Cleartext transmission of information;

• Insufficient Diffie Helman strength; and

• Decompiling Android app

NOTE: Okay, I will admit that I am confused by this advisory. I cannot find a researcher report of these vulnerabilities. If someone wants to step forward and explain this to me, I would appreciate it.

GE Exploit

Ivan Marmolejo has published an exploit for a password denial of service vulnerability in the GE ProficySCADA for iOS. There is no CVE number associated with the exploit report nor any vendor contact reports and I cannot find a report of a similar vulnerability on the GE security advisory page so this looks like a 0-day exploit.

COVID-19

Otorio.com has an interesting blog post about the increase in remote access to industrial systems due to COVID-19. They introduce a fun new term ‘industrial distancing’. It is a quick read, but worth it.

4 Advisories and 6 Updates Published – 10-08-19

Yesterday the DHS NCCIC-ICS published four control system security advisories for products from Siemens (2), GE and SMA Solar Technology. They also updated a medical device advisory for products from BD and five control system advisories for products from Siemens.

SIMATIC Advisory #1

This advisory describes a use of hard-coded cryptographic key vulnerability in the Siemens SIMATIC IT Unified Architecture Discrete Manufacturing (UADM). This vulnerability is self-reported. Siemens has a new version that mitigates the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to gain read and write access to the related TeamCenter station. The Siemens advisory notes that the remote attacker would have to be authenticated and have network access to network access to port 1434/tcp of SIMATIC IT UADM to exploit the vulnerability.

SIMATIC Advisory #2

This advisory describes an uncontrolled resource consumption vulnerability in the Siemens SIMATIC WinAC RTX (F) 2010. The vulnerability was reported by Tal Keren from Claroty. Siemens has provided generic workarounds to mitigate the vulnerability. There is no indication that Keren was provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to perform a denial-of-service attack that could compromise the availability of the service provided by the software.

GE Advisory

This advisory describes two vulnerabilities in the GE Mark VIe Controller. The vulnerabilities were reported by Sharon Brizinov of Claroty. GE provides generic workarounds to mitigate the vulnerability. There is no indication that Brizinov has been proved an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper authorization - CVE-2019-13554; and

• Use of hard-coded credentials - CVE-2019-13918

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to allow an attacker to create read/write/execute commands within the Mark VIe control system.

SMA Advisory

This advisory describes a cross-site request forgery vulnerability in the SMA Sunny WebBox. The vulnerability was reported by Borja Merino and Eduardo Villaverde of the Technical Inspection Laboratory of the Mining School (University of León). SMA provides generic workarounds for this end-of-life product. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to generate a denial-of-service condition, modify passwords, enable services, achieve man-in-the-middle, and modify input parameters associated with devices such as sensors.

BD Update

This update provides additional information on an advisory that was originally published on September 5^th, 2019. The updated information includes:

• Revised affected versions for Pyxis ES Versions; and

• New mitigation measures for all products

Industrial Product Update #1

This update provides additional information on an advisory that was originally published on September 10^th, 2019. The new information includes revised affected versions and mitigation measures for:

• SINUMERIK 840D sl;

• SINUMERIK 828D; and

• SINUMERIK 808D

NOTE: This advisory describes the Siemens response to the Linux TCP SACK PANIC vulnerabilities.

SIMATIC Update #1

This update provides additional information on an advisory that was originally published on March 9^th, 2019 and last updated on July 9^th, 2019. The new information includes:

• Renaming SIMATIC WinAC RTX 2010 to SIMATIC WinAC RTX (F) 2010;

• Updating affected version numbers for SIMATIC WinAC RTX (F) 2010; and

• Providing mitigation information for SIMATIC WinAC RTX (F) 2010

SIMATIC Update #2

This update provides additional information on an advisory that was originally published on May 20^th, 2018 and most recently updated on May 14^th, 2019. The new information includes:

• Renaming SIMATIC WinAC RTX 2010 to SIMATIC WinAC RTX (F) 2010;

• Updating affected version numbers for SIMATIC WinAC RTX (F) 2010; and

• Providing mitigation information for SIMATIC WinAC RTX (F) 2010

Industrial Products Update #2

This update provides additional information on an advisory that was originally published on December 5^th, 2017 and most recently updated on March 12^th, 2019. The new information includes:

• Renaming SIMATIC WinAC RTX 2010 to SIMATIC WinAC RTX (F) 2010;

• Updating affected version numbers for SIMATIC WinAC RTX (F) 2010; and

• Providing mitigation information for SIMATIC WinAC RTX (F) 2010

PROFINET Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and most recently updated on February 5^th, 2019. The new information includes:

• Renaming SIMATIC WinAC RTX 2010 to SIMATIC WinAC RTX (F) 2010;

• Updating affected version numbers for SIMATIC WinAC RTX (F) 2010; and

• Providing mitigation information for SIMATIC WinAC RTX (F) 2010

Other Siemens Announcements

Yesterday Siemens announced a total of five new security advisories and ten advisory updates. Some will be covered (hopefully) later this week by NCCIC-ICS and the remainder I will discuss Saturday.