ICS Public Disclosure – Week of 5-12-18

This week we have two vendor disclosures (ABB), two exploits published for previously disclosed vulnerabilities (Rockwell and Schneider) and two reports of vulnerabilities in a third-party service (Calamp) used by various automotive automation systems. There is also a third vendor (Philips) disclosure that is probably being reported by ICS-CERT next week that I am just mentioning in passing.

ABB Disclosures

ABB reports three vulnerabilities in the Welcome IP-Gateway product. The vulnerabilities were reported by Florian Grunow of ERNW GmbH. ABB has a new version that mitigates the vulnerabilities. There is no indication that Grunow has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Remote code injections – no CVE reported; and

• Missing session management (2) - CVE-2017-7931, and CVE-2017-7906

ABB reports an exploitable RSS function in their Elipse Application. This vulnerability is self-reported. ABB has new versions that mitigate the vulnerability by removing the RSS service.

Rockwell Exploit

t4rkd3vilz published an exploit on ExploitDB.com for the Rockwell CompactLogix SCADA system. The vulnerability that this exploit uses was reported by ICS-CERT in March of 2016.

Schneider Exploit

t4rkd3vilz published an exploit on ExploitDB.com for the Schneider Electric IONXXXX Series Power Meter. The vulnerability that this exploit uses was reported by ICS-CERT in November of 2016.

Calamp Vulnearbilities

Vangelis Stykas has two posts (here and here) and a blog post on two vulnerabilities in backend services provided by Calamp that are used by automotive vendors such as Viper SmartStart and Directed SmartStart. These were coordinated disclosures, patches have been made to the system and Stykas has verified the efficacy of the fix.

Public ICS Disclosures – Week of 04-21-18

This week we have three vendor disclosures from Schneider Electric and one researcher report for cloud services from Hikvision.

Wiser for KNX Advisory

This advisory describes an FTP access vulnerability in the Schneider Wise for KNX logic controller. The vulnerability was reported by Jokin Guevara. Schneider has an update that mitigates the vulnerability. There is no indication that Guevara has been provided an opportunity to verify the efficacy of the fix.

Schneider reports that an uncharacterized attacker could remotely exploit the vulnerability to gain unauthorized access.

EVlink Charging Station Advisory 

This advisory describes a cookie modification privilege escalation in the Schneider EVlink charging station. This vulnerability was reported by Joakim B. Hellum. Schneider has an update that mitigates the vulnerability. There is no indication that Hellum has been provided an opportunity to verify the efficacy of the fix.

Schneider reports that an uncharacterized attacker could remotely exploit the vulnerability to gain administrative privileges without properly authenticating remote users.

Pelco Sarix Professional Advisory 

This advisory describes three vulnerabilities in the Schneider Pelco Sarix Professional IP cameras. The vulnerabilities were reported by Weapon x, Giri Veeraraghavan Veda, and Gulf Business Machines. Schneider has an update available that mitigates the vulnerabilities. There is no indication that any of the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Buffer overflow - CVE-2018-7780;

• Authenticated password disclosure and privilege escalation - CVE-2018-7781; and

• Authenticated password disclosure - CVE-2018-7782

Hikvision Advisory

This advisory describes an authentication vulnerability in the Hikvision hik-connect.com and ezvizlife.com cloud services. The vulnerability was reported by Vangelis Stykas and the hack process reported in depth here (Medium.com registration required). Hikvision has a fix available, but there is no indication that Stykas has been provided an opportunity to verify the fix.