Three Advisories Published – 01-17-19

Today the DHS NCCIC-ICS published three control system security advisories for products from ControlByWeb, ABB and Omron.

ControlByWeb Advisory

This advisory describes two vulnerabilities in the ControlByWeb X-320M web-enabled weather station. The vulnerabilities were reported by John Elder and Tom Westenberg of Applied Risk. ControlByWeb has a firmware update that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper authentication - CVE-2018-18881; and

• Cross-site scripting - CVE-2018-18882

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow arbitrary code execution and could cause the device being accessed to require a physical factory reset to restore the device to an operational state.

ABB Advisory

This advisory describes an improper input validation vulnerability in the ABB CP400 Panel Builder TextEditor. The vulnerability was reported by Ivan Sanchez of NullCode. ABB has a new version that mitigates the vulnerability. There is no indication that Sanchez has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to allow an attacker to execute arbitrary code and cause a denial-of-service condition within the Text Editor application. The ABB security advisory reports that a social engineering attack would be required to get an operator to load a specially crafted file.

NOTE: I briefly discussed this vulnerability back in early December.

Omron Advisory

This advisory describes five vulnerabilities in the Omron CX-Supervisor. The vulnerabilities were reported by Esteban Ruiz (mr_me) of Source Incite via the Zero Day Initiative. Omron has a new version that mitigates the vulnerabilities. There is no indication that Ruiz has been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Code injection - CVE-2018-19011;

• Command injection (2) - CVE-2018-19013 and CVE-2018-19015;

• Use after free - CVE-2018-19017; and

• Type confusion - CVE-2018-19019

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to cause a denial-of-service condition, and/or allow an attacker to achieve code execution with privileges within the context of the application.

NOTE: The Omron release notes for the new version recommended in this NCCIC-ICS advisory lists 8 ZDI reported vulnerabilities (no details currently available on ZDI site) corrected and a couple of other cybersecurity improvements that are included.

Four Advisories and One Update Published – 01-10-19

Yesterday the DHS ICS-CERT published four control system security advisories for products from Tridium, Pilz, Omron and Emerson. They also updated a previously issued advisory for products from Schneider. The Tridium advisory was originally posted to the HSIN ICS-CERT library on November 29, 2018.

Tridium Advisory

This advisory describes a cross-site scripting vulnerability in the Niagara Enterprise Security, Niagara AX, and Niagara 4 products. The vulnerability was reported by Daniel Santos and Elisa Costante of SecurityMatters. Tridium has new versions available that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an authenticated user to inject client-side scripts into some web pages that could then be viewed by other users.

NOTE: The link to the Tridium bulletin is for a .PDF download. Registered users can view the bulletin here.

Pilz Advisory

This advisory describes a clear-text storage of sensitive information vulnerability in the Pilz PNOZmulti Configurator tool. The vulnerability was reported by Gjoko Krstikj of Applied Risk. Pilz has a new version that mitigates the vulnerability. There is no indication that Krstikj was provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow sensitive data to be read from the system.

Omron Advisory

This advisory describes a type confusion vulnerability in the Omron CX-Protocol within CX-One. The vulnerability was reported by Esteban Ruiz (mr_me) of Source Incite via the Zero Day Initiative. Omron has a new version that mitigates the vulnerability. There is no indication that Ruiz has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to execute code under the privileges of the application.

Emerson Advisory

This advisory describes an authentication bypass vulnerability in the Emerson DeltaV Distributed Control System Workstations. The vulnerability was reported by Alexander Nochvay of Kaspersky Lab. Emerson has a patch that mitigates the vulnerability. There is no indication that Nochvay has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to shut down a service, resulting in a denial of service.

Schneider Update

This update provides additional information on an advisory that was originally published on February 23^rd, 2017. The new information includes:

• New researcher acknowledgements; and

• New products affected.

Three Advisories and One Update Published – 12-20-18

Yesterday the DHS NCCIC-ICS published three control system security advisories for products from Rockwell Automation, Schneider Electric and Horner Automation. The also published an update for a previously published advisory for products from OMRON. The Rockwell advisory was originally posted to the HSIN ICS-CERT library on November 27, 2018.

Rockwell Advisory

This advisory describes an heap-based buffer overflow vulnerability on the Rockwell FactoryTalk Services Platform. The vulnerability was reported by Andrey Zhukov. Rockwell has a new version that mitigates the vulnerability. There is no indication that Zhukov has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to diminish communications or cause a complete denial of service to the device.

Schneider Advisory

This advisory describes an open redirect vulnerability in the Schneider EcoStruxure. The vulnerability was reported by Donato Onofri of Business Integration Partners S.p.A. Schneider has new versions that mitigate the vulnerability. There is no indication that Onofri has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability  allow an attacker to use this device as a platform to conduct a phishing attack.

Horner Advisory

This advisory describes an improper input validation vulnerability in the Horner Cscape programming software. The vulnerability was reported by rgod and mdm of 9SG Security Team via the Zero Day Initiative. Horner has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to crash the device being accessed, allow the attacker to read confidential information, and may allow an attacker to remotely execute arbitrary code.

OMRON Update

This update provides new information on an advisory that was originally published on March 13^th, 2018. The new information includes:

• Revision of advisory format;

• Added Esteban Ruiz (mr_me) of Source Incite as an additional vulnerability reporting source; and

• Added new affected versions.

Two Advisories Published – 12-04-18

Earlier this week the DHS NCCIC-ICS published two control system security advisories for products from SpiderControl and Omron.

SpiderControl Advisory

This advisory describes a cross-site scripting vulnerability in the SpiderControl SCADA WebServer. The vulnerability was reported by Ismail Bulbul. SpiderControl has a new version that mitigates the vulnerability. There is no indication that Bulbul has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to execute JavaScript on the victim’s browser.

Omron Advisory

This advisory describes two vulnerabilities in the Omron CX-One application. The vulnerability was reported by Esteban Ruiz (mr_me) of Source Incite via the Zero Day Initiative. Omron has an update that mitigates the vulnerability. There are no indications that Ruiz has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2018-18993; and

• Use after free - CVE-2018-18989

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to execute code under the privileges of the application.

ODD NOTE: This post was actually written on Tuesday night and I was sure that it had been posted, but it is surely not on the blog. I guess I am getting senile in my middle age.

ICS-CERT Publishes 5 Advisories and 4 Updates

Yesterday the DHS ICS-CERT published five control system security advisories for products from Siemens (3) and Fuji electric (2). They also updated three previously published advisories for products from Siemens and the Meltdown/Spectre alert.

SCALANCE Advisory

This advisory describes an improper input validation vulnerability in the Siemens SCALANCE X Switches. The vulnerability is being self-reported. Siemens has updates available for two of the three affected products and has identified mitigation measures.

ICS-CERT reports that a relatively low-skilled attacker could use publicly available exploits to remotely exploit the vulnerability to cause a denial-of-service condition.

SIMATIC Advisory

This advisory describes an improper access control vulnerability in the Siemens SIMATIC WinCC OA HMI. The vulnerability is being self-reported. Siemens has an update available to mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to escalate their privileges in the context of the program.

TD Keypad Designer Advisory

This advisory describes an unprotected search path element vulnerability in the Siemens TD Keypad Designer. The vulnerability is being self-reported. Siemens has identified generic mitigation measures for the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker with local access could exploit the vulnerability  to escalate their privileges.

V-Server Lite Advisory

This advisory describes a classic buffer overflow vulnerability in the Fuji V-Server Lite. The vulnerability was reported by Ariele Caltabiano (kimiya) via the Zero Day Initiative (ZDI). Fuji has a firmware update available to mitigate the vulnerability. There is no indication that Caltabiano has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to view sensitive information and disrupt the availability of the device.

V-Server Advisory

This advisory describes seven vulnerabilities in the Fuji V-Server. The vulnerabilities were reported by Steven Seeley (mr_me) of Source Incite via ZDI. Fuji has a new software version that mitigates the vulnerabilities. There is no indication that Seeley has been provided an opportunity to verify the efficacy of the fix.

The seven reported vulnerabilities are:

• Use after free - CVE-2018-14809;

• Untrusted pointer dereference - CVE-2018-14811;

• Heap-based buffer overflow - CVE-2018-14813;

• Out-of-bounds write - CVE-2018-14815;

• Integer underflow- CVE-2018-14817;

• Out-of-bounds read - CVE-2018-14819; and

• Stack-based buffer overflow - CVE-2018-14823

ICS-CERT reports that a relatively low-skilled attacker could use publicly available exploits to remotely exploit the vulnerabilities to allow for remote code execution on the device, causing a denial of service condition or information exposure.

Industrial Products Update

This update provides new information on an advisory that originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th, February 27^th, 2018, May 3^rd, 2018 and most recently on May 15^th, 2018. The new information includes revised affected versions data and mitigation measures for:

• SINAMICS DCP w. PN; and

• SINAMICS DCM w. PN

SIMATIC Update

This update provides new information on an advisory that was originally published on May 17^th, 2018. The new information includes additional mitigation measures that can be used.

OpenSSL Update

This update provides new information on an advisory that was originally published on August 14^th, 2018. The new information includes revised affected versions data and mitigation measures for WinCC OA.

Meltdown/Spectre Update

This update provides new information on an alert that was originally published on January 11^th, 2018 and updated on January 16^th, 2018, January 17^th, 2018, January 30^th, 2018, February 20^th, 2018, February 22^nd, 2018, March 1^st, 2018, and most recently on July 10^th, 2018. The new information includes a link to a new Meltdown/Spectre advisory from Siemens.

Note: While this newly added advisory from Siemens and another Siemens advisory on the older versions of Meltdown/Spectre address newer versions of the vulnerability, ICS-CERT has failed to provide any information (or links to information) about these new problems.

ICS-CERT Publishes 4 Advisories and 2 Siemens Updates

Yesterday the DHS ICS-CERT published three control system security advisories for products from Advantech, Intel and Vecna. They published a medical device security advisory for products from Becton, Dickinson and Company (BD). They also updated two control system security advisories previously published for products from Siemens. I have previously reported these two updates (here and here).

Advantech Advisory

This advisory describes three vulnerabilities in the Advantech WebAccess HMI Designer. The vulnerabilities were reported by Steven Seeley of Source Incite thru the Zero Day Initiative. No mitigation measures have yet been provided.

The three reported vulnerabilities are:

• Heap-based buffer overflow - CVE-2018-8833;

• Double free - CVE-2018-8835; and

• Out-of-bounds write - CVE-2018-8837

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to remotely execute arbitrary code.

Intel Advisory

This advisory describes a classic buffer overflow vulnerability in the Intel 2G modem products. The vulnerability was reported by Dr. Ralph Phillip Weinmann and Dr. Nico Golde from Comsecuris. Intel is making firmware updates available to device manufacturers that protect systems from this vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The Intel advisory notes that: “The vulnerability affects Intel® 2G Modem products where the Earthquake Tsunami Warning System (ETWS) feature is enabled in Modem firmware.”

ICS-CERT reports that an uncharacterized attacker could remotely exploit this vulnerability to allow remote code execution.

It will be interesting to see if ICS-CERT provides us a list of the affected vendors as they update their products with the new Intel firmware. Given that this is Intel, I suspect that the list of affected vendors could be extensive.

Vecna Advisory

This advisory describes two vulnerabilities in the Vecna VGo Robot, a mobile robotic assistant. The vulnerability was reported by Dan Regalado from Zingbox. Vecna has released an update that mitigates the vulnerability. There are no indications that Regalado has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• OS command injection - CVE-2018-8866; and

• Clear transmission of sensitive information - CVE-2018-8860

ICS-CERT reports that a relatively low-skilled attacker on an adjacent network could exploit the vulnerability to capture firmware updates through network traffic and could allow remote code execution.

BD Advisory

This advisory describes the KRACK vulnerabilities in the BD BD Pyxis Products. BD is reporting being affected by 9 of the 10 reported KRACK vulnerabilities (not reporting - CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake). BD has implemented third-party vendor patches through BD's routine patch deployment process that resolves these vulnerabilities for most devices. The BD advisory that for three of the affected products coordination with customers is necessary to properly deploy patches and they are contacting the affected customers.

SIMATIC Update

This update provides new information on an advisory that was originally published on March 29^th, 2018. The update provides new affected version information and mitigation measures for SIMATIC BATCH V8.0 and V8.1.

SCALANCE Update

This update provides new information on an advisory that was originally published on November 14^th, 2017 and updated on December 5^th, 2017, December 19^th, 2017 and again on January 25^th, 2018. The update provides new affected version information and mitigation measures for SCALANCE W1750D.

ICS-CERT Publishes 2 Advisories and Siemens Update

Yesterday the DHS ICS-CERT published two control system security advisories for products from Beckhoff and Siemens. They also updated a previously published advisory for products from Siemens. The two Siemens products were mentioned in a previous blog post.

Beckhoff Advisory

This advisory describes an untrusted pointer dereference vulnerability in the Beckhoff TwinCAT PLC products. The vulnerability was reported by Steven Seeley of Source Incite. According to the Beckhoff security advisory, the company has updates available that mitigate the vulnerability. There is no indication that Seeley has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to escalate privileges. ICS-CERT reports that Matlab modules need to be recompiled after updating.

Siemens Advisory

This advisory describes an improper access control vulnerability in the Siemens SIMATIC WinCC OA UI mobile app. The vulnerability was reported by Alexander Bolshev from IOActive, and Ivan Yushkevich from Embedi. Siemens has updates available that mitigate the vulnerability. There is no indication that the researchers have verified the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker on an adjacent network could exploit the vulnerability to read and write data from and to the app’s project cache folder. The Siemens security advisory notes that a social engineering attack is required to convince the App user to connect to an attacker-controlled WinCC OA server

Siemens Update

This update provides new information on an advisory that was originally published on January 25th, 2018 and updated on February 6^th. The update removes a product from the affected product list.

ICS-CERT Publishes 5 Advisories and 2 Updates

Today the DHS ICS-CERT published control system security advisories for products from WECON, Siemens, Ecava, PEPPERL+FUCHS and ABB. They also published updates for two previous published advisories for products from Siemens.

WECON Advisory

This advisory describes a heap-based buffer overflow in the WECON LeviStudio HMI. The vulnerability was reported by Michael DePlante working with the Zero Day Initiative (ZDI). WECON notes that the current version mitigates the vulnerability. There is no indication that DePlante was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to crash the device and a buffer overflow condition may allow remote code execution.

Siemens Advisory

This advisory describes a download of code without integrity check vulnerability in the Siemens LOGO! Soft Comfort engineering software product. The vulnerability was reported by Tobias Gebhardt. Siemens is providing SHA-256 checksums for all LOGO! Soft Comfort software packages via a secured HTTPS channel.

ICS-CERT reports that an uncharacterized attacker could remotely exploit the vulnerability to manipulate a software package during download. The Siemens security advisory reports that a successful exploitation would require that the attacker must be able to gain a privileged network position allowing him to capture and modify the affected system’s network communication.

Ecava Advisory

This advisory describes two SQL injection vulnerabilities in the Ecava IntegraXor. The vulnerabilities were independently reported by Steven Seeley of Source Incite, and Michael DePlante and Brad Taylor (working with ZDI). Ecava reports that a newer version mitigates the vulnerability. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to disclose sensitive information from the database or generate an error in the database log.

PEPPERL+FUCHS Advisory

This advisory describes the key reinstallation attacks (KRACK) vulnerabilities in various WLAN enabled products from PEPPERL+FUCHS. This report lists 9 of the 10 KRACK CVE’s. The vendor is still working on fixes for their Android® based products. For their Windows® based products they are recommending that users apply the security update provided by Microsoft. If users are using WPA-TKIP in their WLAN, users should switch to AES-CCMP immediately.

ABB Advisory

This advisory describes an unprotected transport of credentials vulnerability in the ABB Ellipse. ICS-CERT reports that this vulnerability was self-reported by ABB, but the ABB security advisory notes that ABB had received information about this vulnerability through responsible disclosure from an unnamed researcher. ABB has released product updates to mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to discover authentication credentials by sniffing the network traffic. ABB notes that local network access is required for the exploit.

NOTE: I reported on this vulnerability earlier this month.

Industrial Products Update

This update provides additional information on an advisory that was originally published on December 5^th, 2017. It provides updated affected version information and mitigation information for:

• SIMATIC S7-400 H V6: All versions prior to V6.0.8,

• SIMATIC S7-1500: All versions prior to V2.0,

• SIMATIC S7-1500 Software Controller: All versions prior to V2.0,

SCALANCE Update

This update provides additional information on an advisory that was originally published on November 14^th, 2017 and updated on December 5^th, 2017. It provides updated affected version information and mitigation information for:

• RUGGEDCOM RX1400 with WLAN interface: All versions prior to V2.11.2

• SIMATIC RF350M: All versions with Summit Client Utility prior to V22.3.5.16

• SIMATIC RF650M: All versions with Summit Client Utility prior to V22.3.5.16.

Note: Siemens has issued a separate security advisory for the last two products listed above. That advisory only lists two of the 10 KRACK CVEs instead of the 10 listed in the original Siemens KRACK advisory. It is not clear why ICS-CERT merged these two advisories.

ICS-CERT Publishes Hanwha Techwin Advisory

Today the DHS ICS-CERT published an industrial control system advisory for products from Hanwha Techwin. The advisory describes two vulnerabilities in the Hanwha Techwin Smart Security Manager. The vulnerabilities were reported by Steven Seeley of Source Incite. Hanwah Techwin has produced a patch to mitigate the vulnerability. There is no indication that Seely has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Path traversal - CVE-2017-5168; and

• Cross-site request forgery - CVE-2017-5169

ICS-CERT only notes that the vulnerabilities are remotely exploitable and reports that a successful exploit could lead to create an arbitrary file on the server with attacker controlled data as well as an attacker gaining root shell access.

ICS-CERT Publishes Three Advisories

Earlier today the DHS ICS-CERT published three new control system security advisories for products from Meinberg, Unitronics, and Rockwell.

Meinberg Advisory

This advisory describes multiple vulnerabilities in the Meinberg NTP Time Servers Interface. The vulnerabilities were reported by Ryan Wincey. Meinberg has produced a new version that mitigates the vulnerabilities. ICS-CERT reports that Wincey has verified the efficacy of the fix.

The vulnerabilities include:

• Twin stack-based buffer overflows - CVE-2016-3962 and CVE-2016-3988; and

• Privilege escalation - CVE-2016-3989

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to cause a buffer overflow condition that may allow escalation to root privileges.

Unitronics Advisory

This advisory describes a stack-based overflow vulnerability in the Unitronics VisiLogic product. The vulnerability was reported by Steven Seeley of Source Incite via ZDI. Unitronics has produced a new version that mitigates the vulnerability. There is no indication that Seeley has been given an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to remotely execute arbitrary code.

The Unitronics’ CERT Compliance page reports that the vulnerability is in the 'Xceed Zip Compression Library' (the XceedZip.dll), - a 3rd party component from Xceed. Unitronics upgraded to version 6.5.16068.0 in their updated version.

NOTE: Once again a vulnerability in a 3^rd party library raises the question of what other control system programs are using the vulnerable version of this .DLL?

Rockwell Advisory

This advisory describes a resource management vulnerability in the Rockwell Allen-Bradley Stratix 5400 and Allen-Bradley Stratix 5410 industrial networking switches. The vulnerability is apparently self-reported.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to impact traffic (or packets) transiting the affected device.

ICS-CERT Publishes 3 Advisories

This morning the DHS ICS-CERT published three control system advisories for systems from Ecava, Accuenergy, and Sierra Wireless.

Ecava Advisory

This advisory describes multiple vulnerabilities in the Ecava IntegraXor application. The vulnerabilities were independently reported by Steven Seeley of Source Incite and Marcus Richerson. Ecava has produced a new version to mitigate the vulnerabilities. Richerson has tested the new version and verified that it fixed all but one (partially fixed) of the vulnerabilities; Ecava will address that in their next release.

The eight vulnerabilities include:

• Clear text transmission of sensitive information - CVE-2016-2306;

• Cross-site scripting - CVE-2016-2305;

• Improper neutralization of alternate XSS syntax - CVE-2016-2304;

• Improper authorization - CVE-2016-2300;

• SQL injection (2) - CVE-2016-2299 and CVE-2016-2301;

• Information exposure - CVE-2016-2302; and

• Improper neutralization of CLRF sequences in HTTP headers - CVE-2016-2303

ICS-CERT reports that a relatively unskilled attacker could remotely use publicly available exploits to gain complete control of the system.

The Ecava vulnerability note does not mention that one of the vulnerabilities is only partially corrected. Nor does it mention the role of Steven Seeley.

NOTE: There is a minor error in the ICS-CERT advisory. The print version of the link has an incorrect version number (5.0.4522.2 instead of 5.0.4525.2), but the actual link goes to the correct place.

Accuenergy Advisory

This advisory describes twin vulnerabilities in the Accuenergy Acuvim II Series AXM-NET module. The vulnerabilities were reported by Maxim Rupp. Accuenergy has developed suggested user mitigations and there is no indication that a fix is planned for the vulnerabilities.

The vulnerabilities are:

• Authentication bypass issues - CVE-2016-2293; and

• Plain text storage of passwords - CVE-2016-2294

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to execute a denial of service attack on the meter.

The Accuenergy suggested mitigations are very broadly painted instructions designed to deny unauthorized access to the meter. They include the use of firewalls, authentication, and VPN use. No specific information for the use of these techniques with this equipment is provided.

Sierra Wireless Advisory

This advisory describes a file and directory information exposure vulnerability in the Sierra Wireless ACEmanager application. The vulnerability was reported by Maxim Rupp. Sierra Wireless has produced a new version that mitigates the vulnerability, but there is no indication that Rupp has been provided the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to  learn operational characteristics of the gateway.

ICS-CERT Publishes and Advisory and an Agenda

Thursday the DHS ICS-CERT published a new advisory for the Cogent Data Hub application and the final draft agenda for the Industrial Control System Joint Working Group’s (ICSJWG) Spring 2016 meeting.

Cogent Advisory

This advisory describes a privilege escalation vulnerability in the Cogent Data Hub application. The vulnerability was reported by Steven Seeley of Source Incite. Cogent has produced a new version of the software to mitigate the vulnerability and Steven has verified the efficacy of the fix.

ICS-CERT reports that an exploit of this vulnerability would require local access and would require an authorized user to load a malformed file. Given those prerequisites, ICS-CERT says that a relatively unskilled attacker could exploit this vulnerability to escalate their access to system level.

ICSJWG 2016 Spring Agenda

The final draft of the agenda ICSJWG 2016 Spring Meeting. As I had previously noted, this 3-day meeting will be held in Scottsdale, AZ starting May 3^rd, 2016. It looks like a nice mix of presentations in three simultaneous venues. The presentations on the Main stage include:

• How do you know if you are doing enough;

• Building C2M2 and its successful testing at several government and academic institutions;

• Factors that influence the structure of cyber organizations;

• Hands-on demonstration using pre-built wizards;

• NIST Cybersecurity Framework;

• Efforts to develop implementation guidelines in support of the NIST  Cybersecurity Framework;

• Meeting the challenge for cyber assurance with UL cap.

There is a forensics workshop that will be taking place the full three days of the Meeting. Each session will last about 30 minutes. “This hands-on technical workshop will allow attendees to learn recommended best practices for performing hard drive and memory captures on a

live system. Attendees will work one-on-one with ICSCERT’s Advanced Analytical Laboratory staff to learn techniques used to capture forensic copies for analysis.”

ICS-CERT Publishes Unitronics Advisory

This afternoon DHS ICS-CERT published a control systemadvisory for two vulnerabilities reported in the Unitronics VisiLogic OPLC IDE. The vulnerabilities were reported (through ZDI) by Steven Seeley of Source Incite, Fritz Sands of ZDI, and Andrea Micalizzi. Unitronics has produced an update package but there is no indication that any of the researchers were provided the opportunity to verify the efficacy of the fix.

The two vulnerabilities were:

• Unsafe ActiveX control marked safe for scripting – CVE-2015-6478; and

• Code injection – CVE-2015-7905

ICS-CERT reports that a moderately skilled attacker could remotely exploit these vulnerabilities to execute arbitrary code.

There is nothing on the Unitronics web site or in the version documentation that describes the security vulnerabilities. There is the possibility that Unitronics directly contacted their customers during the period that this vulnerability was listed on the US CERT Secure Portal (posted November 3^rd, 2015).

Actually, looking at the vulnerability ID number assigned by ICS-CERT (ICSA-15-274-02) it would seem that the advisory was probably placed on the Secure Portal on October 1^st when the Omron advisory (ICSA-15-274-01) was published. Either that, or something happened at the last minute to cause ICS-CERT to hold the advisory for more than a month.

BTW: If you had been following the ICS-CERT notices on the Secure Portal, you would have already known about this vulnerability. If you are a critical infrastructure owner or cybersecurity officer see the bottom of the ICS-CERT landing page for instructions on how to apply for access.