1 Advisory and 1 Update Published – 8-27-20

Today the CISA NCCIC-ICS published a control system security advisory for products from Red Lion and updated a medical device security advisory for products from OpenClinic GA.

Red Lion Advisory

This advisory describes five vulnerabilities in the Red Lion N-Tron 702W series products. The vulnerabilities were reported by Thomas Weber from SEC Consult Vulnerability Lab. These products went out of support in 2018 and cannot be updated.

The five reported vulnerabilities are:

• Cross-site scripting - CVE-2020-16210 and CVE-2020-16206,

• Cross-site request forgery - CVE-2020-16208,

• Backdoor - CVE-2020-16204, and

• Use of unmaintained third-party components - CVE-2017-16544

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to gain unauthorized access to sensitive information, execute system commands, and perform actions in the context of an attacked user.

NOTE: There are multiple proof-of-concept exploits available for the last vulnerability, actually multiple vulnerabilities. Some of those exploits of the BusyBox vulnerabilities can be found here, here and here.

OpenClinic Update

This update provides additional information on an advisory that was originally published on July 2^nd, 2020. The new information includes three CVE numbers for vulnerabilities covered under the single listed ‘use of unmaintained third-party components vulnerability’; those CVE’s are

• CVE-2014-0114 (Apache Struts, improper input validation, multiple exploits)

• CVE-2016-1181 (Apache Struts, insufficient information, multiple exploits), and

• CVE-2016-1182 (Apache Struts, improper input validation, multiple expoits)

Public ICS Disclosure – Week of 2-29-20

This week we have lots of new ‘information’ on SweynTooth vulnerabilities and three vendor disclosures for products from Rockwell, Phoenix Contact and Moxa.

SweynTooth

In addition to the CISA alert for the SweynTooth  Bluetooth vulnerabilities published this week there was an advisory from the FDA and brief disclosures from the following medical device vendors:

• GE Healthcare;  

• Johnson and Johnson;

• Medtronic;

• BD; and

• Drager

Rockwell Advisory

Rockwell published an advisory describing four vulnerabilities in their MicroLogix Controllers and RSLogix 500 Software. The vulnerabilities were reported by Ilya Karpov, Evgeny Druzhinin from ScadaX Security and Dmitry Sklyarov from Positive Technologies. Rockwell has new versions for some products that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Use of hard-coded cryptographic key - CVE-2020-6990;

• Use of broken or risky algorithm for password protection - CVE-2020-6984;

• Use of client-side authentication - CVE-2020-6988; and

• Unsecured SMTP data storage - CVE-2020-6980

Phoenix Contact Advisory

Phoenix Contact published an advisory [.PDF download link] describing three vulnerabilities in their  TC ROUTER & TC CLOUD CLIENT devices. The vulnerabilities were reported by Thomas Weber, SEC Consult Vulnerability Lab. Phoenix Contact has new firmware that mitigates the vulnerability. There is no indication that Weber was provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper control of generation of code - CVE-2017-16544;

• Command injection - CVE-2020-9436; and

• Hard-coded certificate - CVE-2020-9435

NOTE: the first vulnerability is an old library problem that has lots of exploits available.

Moxa Advisory

Moxa published an advisory describing an improper authentication vulnerability in their MGate MB3180/MB3280/MB3480/MB3170/MB3270 Series Protocol Gateways. This is a self-reported vulnerability. Moxa has new firmware versions available that mitigate the vulnerability.