Review – Public ICS Disclosure – Week of 10-29-22

This week we have twelve vendor disclosures about the recent OpenSSL vulnerabilities from Aruba Networks, Broadcom, Keysight, Milestone, Moxa, Palo Alto Networks, Roche, Rockwell Automation, Software Toolbox, Watchguard, and Wind River.   We also have twelve other vendor disclosures from Belden, Hitachi, Insyde (6), Sick, and Tanzu (3). There are six vendor updates for products from CODESYS. Finally, we have two exploits for products from FLIR, and Veeder-Root.

OpenSSL Vulnerabilities Disclosures

Aruba reports that none of their products are affected by the vulnerabilities.

Broadcom provides a list of unaffected products.

Dell reports that they are reviewing their products to see which may be affected by the vulnerabilities.

Keysight reports that none of their products are affected by the vulnerabilities.

Milestone reports limited impact in their XProtect VMS 2022 R3. An update is pending.

Moxa reports that none of their products are affected by the vulnerabilities.

Palo Alto Networks reports that earlier versions of Cortex XDR Broker VM contain the affected OpenSSL version but are not affected by the vulnerabilities. Other products are not affected.

Roche reports that none of their products are affected by the vulnerabilities.

Rockwell reports that they are reviewing their products to see which may be affected by the vulnerabilities.

Software Toolbox reports that none of their products are affected by the vulnerabilities.

Watchguard provides a list of unaffected products.

Wind River provides a list of affected products. Fixes are pending.

Other Vendor Disclosures

Belden Advisory - Belden published an advisory that describes a command insertion vulnerability in their (Hirschmann) Industrial HiVision product.

Hitachi Advisory - Hitachi published an advisory that discusses 60 vulnerabilities in their Disk Array Systems. These are third-party (Microsoft) vulnerabilities

Insyde Advisory #1 - Insyde published an advisory that discusses an observable discrepancy vulnerability in their InsydeH2O product.

Insyde Advisory #2 - Insyde published an advisory that discusses two vulnerabilities in their InsydeH2O product.

Insyde Advisory #3 - Insyde published an advisory that discusses an out-of-bounds read vulnerability in their InsydeH2O product.

Insyde Advisory #4 - Insyde published an advisory that describes a stack-based buffer overflow vulnerability in their InsydeH2O product.

Insyde Advisory #5 - Insyde published an advisory that describes a stack-based buffer overflow in their InsydeH2O product.

Insyde Advisory #6 - Insyde published an advisory that describes a stack-based buffer overflow in their InsydeH2O product.

Sick Advisory - Sick reports a denial of service vulnerability in their FlexiCompact product.

NOTE: The Sick PSIRT web page continues to have problems with inoperable links.

Tanzu Advisory #1 - Tanzu published an advisory that describes a privilege escalation vulnerability in their pring-security-oauth2-client.

Tanzu Advisory #2 - Tanzu published an advisory that describes an authorization bypass vulnerability in their Spring Security product.

Tanzu Advisory #3 - Tanzu published an advisory that describes a remote code execution vulnerability in their Spring Tools 4 for Eclipse product.

CODESYS Update #1 - CODESYS published an update for their CODESYS communication server advisory that was originally published on May 19^th, and most recently updated on October 6^th, 2022.

CODESYS Update #2 - CODESYS published an update for their V3 web server advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th, 2022.

CODESYS Update #3 - CODESYS published an update for their a CODESYS communication server advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th, 2022.

CODESYS Update #4 - CODESYS published an update for their Control V3 online user management advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th 2022.

CODESYS Update #5 - CODESYS published an update for their V3 products using the CODESYS communication protocol advisory that was originally published on March 24^th, 2022 and most recently updated on June 30^th, 2022.

CODESYS Update #6 - CODESYS published an update for their Control V3 configuration file advisory that was originally published on March 24th, 2022, and most recently updated on October 6^th, 2022.

Exploits

FLIR Exploit - Samy Younsi published a Metasploit module for a command injection vulnerability in the FLIR AX8 infrared monitoring camera.

Veeder-Root Exploit - Rose Security published an exploit for a remote configuration disclosure vulnerability in the Veeder-Rood (and probably other vendor) automated tank gauges.

 

For more details about these disclosures, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-10-c49 - subscription required.

 

Review – 11 Advisories and 1 Update Published – 8-30-22

Today, CISA’s NCCIC-ICS published eleven control system security advisories for products from Johnson Control, PTC Kepware, Omron, Honeywell (3), Fuji Electric, and Hitachi Energy (4). They also updated an advisory for products from Mitsubishi Electric.

Johnson Control Advisory - This advisory describes a command injection vulnerability in the Johnson Control (Tyco subsidiary) iSTAR Ultra door controller.

PTC Advisory - This advisory describes two vulnerabilities on the Kepware KEPServerEX connectivity platform.

NOTE: NCCIC-ICS reports that these vulnerabilities also affect the following products as thirdparty vulnerabilities:

• Rockwell Automation KEPServer Enterprise,

• GE Digital Industrial Gateway Server, and

• Software Toolbox TOP Server

Honeywell Advisory #1 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell Trend Controls IQ Series IC.

Honeywell Advisory #2 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell Experion LX distributed control system.

Honeywell Advisory #3 - This advisory discusses an OT:ICEFALL vulnerability in the Honeywell ControlEdge PLC.

Fuji Advisory - This advisory describes two vulnerabilities in the Fuji D300win programming support tool.

Hitachi Energy Advisory #1 - This advisory describes an improper input validation vulnerability in the Hitachi Energy RTU500.

Hitachi Energy Advisory #2 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy MSM Product.

NOTE: I briefly discussed the 13 underlying vulnerabilities (3 with known exploits) on July 16^th, 2022.

Hitachi Energy Advisory #3 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy Gateway Station product.

NOTE: I briefly discussed the 7 underlying vulnerabilities (6 with known exploits) on May 8^th, 2022.

Hitachi Energy Advisory #4 - This advisory describes a reliance on uncontrolled component vulnerability in the Hitachi Energy FACTS Control Platform product.

NOTE: I briefly discussed the 7 underlying vulnerabilities (6 with known exploits) on May 8^th, 2022.

Mitsubishi Update - This update provides additional information for an advisory that was originally published on August 9th, 2022 and most recently updated on August 18^th, 2022.

 

For more details on these advisories and the update, including links to third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-and-1-update-published - subscription required.

Review – Public ICS Disclosures – Week of 7-30-22

This week we have eleven vendor disclosures from Belden, Bosch, DrayTek, HPE, Meinberg, Mitsubishi, OPC Foundation, PulseSecure, Software Toolbox (2), and VMware. There are also two updates from Belden and HP.

 

Belden Advisory - Belden published an advisory that describes a denial of service vulnerability in their Hirschmann EagleSDV.

Bosch Advisory - Bosch published an advisory that describes two vulnerabilities in the their BF-OS. Bosch

DrayTek Advisory - DrayTek published an advisory that describes a remote code execution vulnerability in their Vigor Routers.

NOTE: The DrayTek advisory includes an actual link to the Trellix report. That is full disclosure.

HPE Advisory - HPE published an advisory that discusses a directory traversal vulnerability in their B-series Fibre Channel SAN Switch.

Meinberg Advisory - Meinberg published an advisory that discusses fifteen vulnerabilities (13 with available exploits) in their LANTIME firmware.

Mitsubishi Advisory - Mitsubishi published an advisory that discusses two vulnerabilities in their GT SoftGOT2000.

NOTE: The Mitsubishi advisory notes that these vulnerabilities affect “multiple FA products”, but only one product is currently listed. We may see additional products added in future updates.

OPC Foundation - The OPC Foundation published an advisory that describes an exposure of sensitive information to an unauthorized actor vulnerability in their OPC UA .NET Standard Reference Server.

PulseSecure Advisory - PulseSecure published an advisory that discusses an OS command injection vulnerability.

Software Toolbox Advisory #1 - Software Toolbox published an advisory that discusses the DICOM hardening vulnerability in their OPC Quick Client.

Software Toolbox Advisory #2 - Software Toolbox published an advisory that discusses the DICOM hardening vulnerability in their Top Server.

VMware Advisory - VMware published an advisory that describes ten vulnerabilities (with one known exploit) in multiple products.

Belden Update - Belden published an update for their FragAttacks advisory that was originally published on March 14^th, 2022.

HP Update - HP published an update for their Wireless Bluetooth advisory that was originally published on February 8th, 2022 and most recently updated on June 13^th, 2022.

 

For more details on these disclosures, including links to 3^rd party advisories, researcher reports and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-7-ec0 - subscription required.

Review – Public ICS Disclosure – Week of 7-23-22- Part 1

It is a fairly busy summer week for disclosures.  In Part 1 this week we have thirteen vendor disclosures from ABB, Aruba Networks, Broadcom (2), CONTEC, Dell, Hitachi Energy (2), HPE, Meinberg, Software Toolbox, Western Digital, and Yokogawa. We will have vendor updates, researcher reports, and new exploits in Part 2.

ABB Advisory - ABB published an advisory that describes three vulnerabilities in their Ability™ Operations Data Management Zenon.

Aruba Advisory - Aruba published an advisory that describes a sensitive information disclosure vulnerability in their Aruba Virtual Intranet Access application.

Broadcom Advisory #1 - Broadcom published an advisory that describes a path traversal vulnerability in their Brocade Fabric OS.

Broadcom Advisory #2 - Broadcom published an advisory that discusses the RETbleed vulnerabilities.

CONTEC Advisory - JP CERT published an advisory that describes a file upload vulnerability in the CONTEC SolarView Compact product.

Dell Advisory - Dell published an advisory that discusses an allocation of resources without limits or throttling vulnerability in their Data Protection Advisor.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that discusses a classic buffer overflow vulnerability in their AFF660/665 series product web server.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that discusses two vulnerabilities (one with known exploit) in their Lumada Asset Performance Management (APM) Edge product.

NOTE: According to NVD.NIST.gov the first vulnerability is listed on CISA's Known Exploited Vulnerabilities (KEV) Catalog list.

HPE Advisory - HPE published an advisory that describes eleven vulnerabilities in their Integrated Lights-Out 5 firmware.

Meinberg Advisory - Meinberg published an end-of-life announcement for their LANTIME Operating System Version 6, effective January 1^st, 2023.

Software Toolbox Advisory - Software Toolbox published an advisory that discuses an out-of-bounds write vulnerability with known exploits.

Western Digital Advisory #1 - Western Digital published an advisory that describes four cryptographic processing vulnerabilities in their Sweet B cryptographic library.

Western Digital Advisory #2 - Western Digital published an advisory that discusses eight vulnerabilities (six with known exploits) in their My Cloud OS 5 firmware.

Yokogawa Advisory - Yokogawa published an advisory that describes a resource management error vulnerability in their CENTUM controller FCS.

 

For more details on these advisories, including links to 3^rd-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-7-23 - subscription required.

Review – Public ICS Disclosure – Week of 5-28-22

This week we have ten vendor disclosures from CODESYS (3), Dell, Endress+Hauser, Mitsubishi, Moxa, Software Toolbox (2), and T&D. We also have nine vendor updates from Aruba Networks, CODESYS, Fujitsu, HP, HPE (4), and Palo Alto Networks. There are also two researcher reports for products from Korenix, and Schneider Electric. Finally, we have three exploits published for products from SolarView, and Ingredient Stock Management System (2).

CODESYS Advisory #1 - CODESYS published an advisory that describes two uncontrolled resource consumption vulnerabilities in their CODESYS V3 products containing a CODESYS communication server.

CODESYS Advisory #2 - CODESYS published an advisory that describes a plain-text storage of password vulnerability in their OPC DA Server.

CODEESYS Advisory #3 - CODESYS published an advisory that describes an observable response discrepancy in their Visualization products.

Dell Advisory - Dell published an advisory that describes three vulnerabilities in their Wyse Management Suite (one is a third-party (JQuery) vulnerability.

Endress+Hauser Advisory - CERT VDE published an advisory that discusses eight vulnerabilities in multiple products from Endress +HYauser.

Moxa Advisory - Moxa published an advisory that discusses the DirtyPipe vulnerability.

Software Toolbox Advisory #1 - Software Toolbox published an advisory that discusses a security feature bypass vulnerability in their OPC Quick Client.

Software Toolbox Advisory #2 - Software Toolbox published an advisory that discusses a security feature bypass vulnerability for customers using OPC Classic.

T&D Advisory - T&D published an advisory that describes a directory traversal vulnerability in the T&D Data Server and THERMO RECORDER DATA SERVER.

Aruba Update #1 - Aruba published an update for their Expat XML advisory that was originally published on May 17^th, 2022.

Aruba Update #2 - Aruba published an update for their OpenSSL advisory that was originally published on May 4^th, 2022.

Fujitsu Update - JP CERT published an update for their FUJITSU Network IPCOM advisory that was originally published on  May 19^th, 2022.

CODESYS Update - CODESYS published an update for their Development System V3 advisory that was originally published on July 15^th, 2021 and most recently updated on August 2^nd, 2021.

HP Update - HP published an update for their HP Print Products advisory that was originally published on March 21^st, 2022, and most recently updated on May 3^rd, 2022.

HPE Update #1 - HPE published an update for their Intel Bios advisory that was originally published on May 10^th, 2022.

HPE Update #2 - HPE published an update for their ProLiant DX Servers advisory that was originally published on May 10^th, 2022.

HPE Update #3 - HPE published an update for their Synergy Servers advisory that was originally published on May 10^th, 2022.

HPE Update #4 - HPE published an update for their ProLiant BL/DL/ML/XL/MicroServer that was originally published on May 10^th, 2022.

Palo Alto Networks Update - Palo Alto Networks published an update for their OpenSSL advisory that was originally published on March 31^st, 2022 and most recently updated on May 12^th, 2022.

Korenix Report - SEC Consult published a report describing a backdoor account in the Korenix JetPort serial converter.

Schneider Report - Zero Science published a report describing a remote root exploit vulnerability (with exploit available) in the Schneider C-Bus Automation Controller.

SolarView Exploit - Ahmed Alroky published an exploit for directory traversal vulnerability in the SolarView Compact.

Ingredient Stock Management System Exploit #1 - Saud Alenazi published an exploit for an SQL injection vulnerability in the Ingredient Stock Management System.

Ingredient Stock Management System Exploit #2 - Saud Alenazi published an exploit for an account takeover vulnerability in the Ingredient Stock Management System.

 

For more details about these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosure-week-of-5-28 - subscription required.

Review – Public ICS Disclosures – Week of 4-30-22 – Part 2

For Part 2 we have 20 additional vendor disclosures from Hitachi Energy (3), HPE (2), Moxa, QNAP (4), Rockwell Automation, Sick (2), and Splunk (7). We also have an update from Software Toolbox. Finally, we have an exploit for products from VMware.

Hitachi Energy Advisory #1 - Hitachi Energy published an advisory that discusses seven vulnerabilities (six with known exploits) in their Gateway Station (GWS) Product.

Hitachi Energy Advisory #2 - Hitachi Energy published an advisory that discusses seven vulnerabilities (six with known exploits) in their FACTS Control Platform (FCP) Product.

Hitachi Energy Advisory #3 - Hitachi Energy published an advisory that discusses the SpringShell vulnerabilities in their Lumada APM’s Prognostic Model Executor Service.

HPE Advisory #1 - HPE published an advisory that discusses an unspecified vulnerability in their HP-UX RPC services library.

HPE Advisory #2 - HPE published an advisory that discusses eight vulnerabilities (three with known exploits) in their B-Series SANnav Management Portal.

Moxa Advisory - Moxa published an advisory that describes an improper control of generation of code vulnerability in their MXview product.

QNAP Advisory #1 - QNAP published an advisory that describes four vulnerabilities in their QTS, QuTS hero, and QuTScloud.

QNAP Advisory #2 - QNAP published an advisory that describes an improper authentication vulnerability in their Photo Station product.

QNAP Advisory #3 - QNAP published an advisory that describes two vulnerabilities in their Video Station product.

QNAP Advisory #4 - QNAP published an advisory that describes a path traversal vulnerability in their NAS products.

Rockwell Advisory - Rockwell published an advisory that discusses third-party vulnerabilities in their FactoryTalk® ProductionCentre.

Sick Advisory #1 - Sick published an advisory that describes a malformed UDP package vulnerability in their Flexi Soft, Flexi Compact and the EFI gateway UE4740 products.

Sick Advisory #2 - Sick published an advisory that describes an uncontrolled resource consumption vulnerability in their Gateway Flexi Soft. 

Splunk Advisory #1 - Splunk published an advisory that describes an error message discloses internal path vulnerability in their Enterprise product.

Splunk Advisory #2 - Splunk published an advisory that describes a path traversal vulnerability in their Enterprise product.

Splunk Advisory #3 - Splunk published an advisory that describes a reflected cross-site scripting vulnerability in their Enterprise product.

Splunk Advisory #4 - Splunk published an advisory that describes a security bypass vulnerability in their Enterprise product.

Splunk Advisory #5 - Splunk published an advisory that describes an authentication bypass vulnerability in their Enterprise product.

Splunk Advisory #6 - Splunk published an advisory that describes a useable discrepancy vulnerability in their Enterprise product.

Splunk Advisory #7 - Splunk published an advisory that describes a privilege escalation vulnerability in their Enterprise Windows product.

Software Toolbox Update - Software Toolbox published an update for their INCONTROLLER ICS attack tools advisory that was originally published on April 22^nd, 2022.

VMware Exploit - Mr me published a Metasploit module for a code injection vulnerability in the VMware Workspace ONE Access, Identity Manager and vRealize Automation products.

 

For more details on these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-4-0b6 - subscription required.

Public ICS Disclosure – Week of 1-9-21 – Part 1

This week we have six vendor disclosures from Advantech, PEPPERL+FUCHS, WAGO, Philips, RUCKUS, and Rockwell (2). We have five vendor updates from Carestream, Mitsubishi, Rockwell, Siemens, and Software Toolbox.

Advantech Advisory

Advantech published an advisory describing six vulnerabilities in their Spectre RT ERT351 and

B+B SmartWorx ERT351 products. The vulnerabilities were reported by Vlad Komarov of ScadaX, and Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar. Advantech has new firmware versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Improper neutralization of input during web page generation - CVE-2019-18233,

• Cleartext transmission of sensitive information - CVE-2019-18231,

• Improper restriction of excessive authentication attempts - CVE-2019-18235 (Linux vuln),

• Insufficiently protected credentials (no CVE number),

• Usage of broken or risky cryptographic algorithm - CVE-2019-18237,

• Use of vulnerable third-party software - CVE-2019-18239 (OpenSSH and OpenSSL)

PEPPERL+FUCHS Advisory

CERT VDE published an advisory describing a deserialization of untrusted data vulnerability in the PEPPERL+FUCHS PACTware product. This is a third-party (fdtCONTAINER component by M&M Software GmbH) vulnerability. The vulnerability was reported by M&M Software. The vulnerability will be corrected in a version to be released in the second quarter.

WAGO Advisory

CERT VDE published an advisory describing a deserialization of untrusted data vulnerability in unnamed WAGO workstations. This is the same third-party (M&M Software) vulnerability described above.

Philips Advisory

Philips published an advisory describing an undescribed vulnerability on products running on their older Haswell workstations. Philips has a patch that mitigates the vulnerability.

RUCKUS Advisory

RUCKUS published an advisory describing two vulnerabilities in the LLDP module of Ruckus Network’s AP products. These are third-party library vulnerabilities originally reported by Florian Weimer (see links below for original reporting). RUCKUS has patches that mitigate the vulnerabilities.

The two reported vulnerabilities are:

• Classic buffer overflow - CVE-2015-8011, and

• Reachable assertion - CVE-2015-8012

Rockwell Advisories

Rockwell published an advisory describing a side-channel leakage vulnerability in the NXP 7x Secure Authentication Microcontrollers. This is a third-party (Google Titan Security Key) vulnerability reported by NinjaLab. Rockwell provides generic mitigation measures.

NOTE: This is going to be an interesting one for a variety of vendors.

 

Rockwell published an advisory describing the third-party (M&M Software) fdtCONTAINER vulnerability described above in their FactoryTalk AssetCentre products. Rockwell has a software update that mitigates the vulnerability.

NOTE: Third-party vulnerabilities strike far and wide (SIGH).

Carestream Update

Carestream published an update [.PDF download link] for their Bad Neighbor advisory that was originally published on October 15^th, 2020. The new information includes:

• A list of unaffected products, and

• A list of two affected products (Image Suite and Omni) with mitigation measures.

Mitsubishi Update

Mitsubishi published an update for their MC Works 64 advisory that was originally published on June 18^th, 2020 and most recently updated on December 8^th, 2020. The new information includes adding mitigation measures for MC Works64 Version 2.00A - 2.02C.

NOTE: NCCIC-ICS published an advisory for these vulnerabilities back in June but has not yet updated it for any of the updates that Mitsubishi has published. This is probably due to a failure by Mitsubishi to inform NCCIC-ICS of the updates.

Rockwell Update

Rockwell published an update for their FactoryTalk Linx advisory that was originally published on December 27^th, 2020. The new information includes links to mitigation measures for three of the vulnerabilities.

Siemens Update

Siemens published an out-of-zone update for their SolidEdge advisory that was originally published on January 12^th, 2021. The new information includes additional mitigation information for SolidEdge SE2020.

Software Toolbox Update

Software Toolbox published an update for their TopServer advisory that was originally published on December 9^th, 2020. The new information includes adding the CVE numbers for the included vulnerabilities.

NOTE: This advisory was included in  ICSA-20-352-02. This update will probably not be mentioned by NCCIC-ICS since the link provided in their advisory takes one to this update.

ICS-CERT Publishes Three Advisories

This afternoon the DHS ICS-CERT published three advisories in control systems from Schneider, Kepware and Software Toolbox.

Schneider Advisory

This advisory describes a buffer overflow vulnerability in the Schneider Invensys SRD Control Valve Positioner. The vulnerability was reported by Ivan Sanchez from Nullcode Team. Schneider has produced a new version of the software that mitigates the vulnerability, but there is no indication that Sanchez has verified the efficacy of the fix.

ICS-CERT reports that a local user is required to load a malformed DLL file before the vulnerability is exploitable. A successful exploit could result in arbitrary code execution. Schneider reports that once the DLL file is loaded the vulnerability is remotely exploitable. They don’t mention anything about loading a ‘malformed DLL file’; it is apparently a DLL file that is part of the software package.

Kepware Advisory

This advisory describes a resource exhaustion vulnerability reported by Crain and Sistrunk (back in December 2013 according to Adam Crain) in the Kepware DNP Master Driver. Kepware has produced a new version that mitigates the vulnerability, though there is no indication that Crain or Sistrunk have verified the efficacy of the fix.

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability to crash the OPC Server.

The ICS-CERT discussion of the vulnerability appears to imply that a similar vulnerability might be found in other implementations of the DNP3 protocol. It notes that there is a DNP3 Application Note addressing the situation.

This looks like it was one of two remaining unresolved DNP3 vulnerabilities listed on the Project Robus website.

Software Toolbox Advisory

This advisory is a near duplicate of the Kepware advisory discussed above except that it involves the Software Toolbox Top Server. If this is, in fact, the second unresolved DNP3 vulnerability listed on the Project Robus site, I kind of suspect that these two vendors may be the only two with this specific implementation issue. Crain-Sistrunk would have looked for this in other implementations; they are kind of thorough that way.

ICS-CERT Publishes Two Advisories – Schneider and Top Server

Today the DHS ICS-CERT published two control system advisories; one for an encryption vulnerability in the Schneider Electric Trio J-Series Radios and one for an input validation vulnerability in the Software Toolbox TOP Server DNP Master OPC product.

Schneider Vulnerability

This advisory concerns a self-reported hard-coded encryption key vulnerability (NOTE: The Schneider web site reports that this vulnerability was reported by an unnamed security researcher). Some versions of the firmware in the Trio J-Series License Free Ethernet Radio does not properly generate an AES encryption key. Schneider reports that simply upgrading to a newer version of the firmware does not necessarily correct the problem.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to take control of the communications network and the control system attached to it. Schneider reports that they have updated firmware, that properly applied, will mitigate the problem. There is no indication that the original researcher has validated the update.

NOTE: Schneider identified this problem and solution in May and posted it on their web site on August 8^th. That delay was almost certainly due to attempting to notify customers of the problem. The delay in the ICS-CERT reporting of this issue is not explained.

TOP Server Vulnerability

This advisory concerns an improper input validation vulnerability on the TOP Server DNP Master OPD product identified by Adam Crain and Chris Sistrunk. Oh, hell, just read my Kepware blog post of last week; this advisory is for the same vulnerability in the same system, it’s just marketed under a different label. Adam pointed this out to ICS-CERT but they would not add it to the earlier advisory. Adam and Chris get credit for another coordinated disclosure because they pushed ICS-CERT to publish this advisory so that the TOP Server owners would understand that this vulnerability applied to them.

This is an ongoing problem with hardware, software and firmware sold under different names or included in other systems. As more of these types of vulnerabilities are reported blackhats will begin to realize that systems are vulnerable because owners don’t realize that available patches and upgrades apply to their equipment. ICS-CERT needs to step up and be proactive in these types of situations and not have to be pressured into acting by concerned researchers.

BTW: The Project Robus web site takes credit for this advisory and reports that there are now 17 disclosures pending.