Public ICS Disclosures – Week of 9-19-20

This week we have two vendor disclosures about the CodeMeter vulnerabilities from Bosch and 3S. There are four vendor disclosures for products from Mitsubishi (2), Yokogawa, and Eaton. We also have two researcher reports for vulnerabilities in products from Siemens and Aveva.

CodeMeter Advisories

Bosch published an advisory describing the CodeMeter vulnerabilities in their Rexroth Products. Bosch recommends updating the CodeMeter software. One Bosch update is available to mitigate the vulnerabilities.

3S published an advisory [.PDF download link] describing the CodeMeter vulnerabilities in a number of their products. 3S has new versions of CODESYS V3 that mitigates the vulnerability.

NOTE: This advisory would seem to indicate that the universe of vulnerable products is much larger than previously thought. Vendors using CODESYS products would not have known to check for the CodeMeter vulnerability in their systems.

Mitsubishi Advisories

Mitsubishi published an advisory describing a TCP/IP stack session management vulnerability in a number of their products. The vulnerabilities were reported by Ta-Lun Yen of Trend Micro via the Zero Day Initiative. Mitsubishi has new versions that mitigate the vulnerability in many of the affected products. There is no indication that Ta-Lun has been provided an opportunity to verify the efficacy of the fix.

Mitsubishi published an advisory describing the Ripple20 vulnerabilities in the WiFi interface for a number of their products. Mitsubishi provides generic workarounds for the vulnerabilities.

NOTE: There is no overlap in the product lists for the two advisories which would indicate that two different TCP/IP stacks are being used.

Yokogawa Advisory

Yokogawa published an advisory describing a classic buffer overflow vulnerability in their  FA-M3 Programming Tool. The vulnerability has been reported by Parity Dynamics. Yokogawa has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Eaton Advisory

Eaton published an advisory describing an uncontrolled search path element vulnerability in their 9000x programing and configuration software. The vulnerability was reported by Yongjun liu. Eaton has a new version that mitigates the vulnerability. There is no indication that Yongjun has been provided an opportunity to verify the efficacy of the fix.

Siemens Report

Otorio published a blog post describing two vulnerabilities in the Siemens PCS 7 products. According to the post Siemens will provide instruction to avoid the vulnerabilities in the “next update of SIMATIC PCS 7 Compendium Part F”.

The two reported vulnerabilities are:

• A WinCC configuration flaw, and

• A PCS 7 configuration flaw.

NOTE: I cannot find a Siemens advisory that addresses similarly described vulnerabilities, but without a CVE number I cannot really be sure that Siemens has not addressed them.

Aveva Report

Talos published a report describing three vulnerabilities in the Aveva Enterprise Data Management Web data management platform. These vulnerabilities were previously disclosed by Aveva. The Talos report includes proof-of-concept code.

Public ICS Disclosures – Week of 04-11-20

This week we have five vendor disclosures for products from Schneider (4) and OPC Foundation. We also have nine updated advisories for products from Schneider (4) and Siemens (5).

Schneider Advisories

Schneider published an advisory describing an injection vulnerability in their Modicon M100/M200/M221 controllers, SoMachine Basic and EcoStruxure Machine Expert - Basic products. The vulnerability was reported by Seok Min Lim and Johnny Pan of Trustwave. Schneider has updated software and firmware that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing two vulnerabilities in their Modicon M218/M241/M251/M258 Logic Controllers, SoMachine & SoMachine Motion, and EcoStruxure Machine Expert products. The vulnerabilities were reported by Rongkuan Ma, Shunkai Zhu and Peng Cheng of 307Lab. Schneider has new versions to mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Insufficient verification of data authenticity - CVE-2020-7487; and

• Clear-text transmission of sensitive data - CVE-2020-7488

Schneider published an advisory describing an untrusted search path vulnerability in their Vijeo Designer and Vijeo Designer Basic Software products. The vulnerability was reported by Yongjun Liu of nsfocus. Schneider has a new version that mitigates the vulnerability. There is no indication that Yongjun has been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing four vulnerabilities in their legacy Triconex product. These vulnerabilities are self-reported. Schneider reports that newer versions corrected the vulnerabilities.

The four reported vulnerabilities are:

• Password vulnerability (2) - CVE-2020-7483 and CVE-2020-7484;

• Improper access - CVE-2020-7485; and

• Denial of service - CVE-2020-7486

OPC Foundation Advisory

OPC published an advisory describing an malformed message vulnerability in their UA .NET Standard Stack. The vulnerability was reported by Steven Seeley (mr_me) and Chris Anastasio (muffin) via the Zero Day Initiative. OPC has updates available that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Schneider Updates

Schneider has published an update for their Urgent/11 advisory that was originally published on August 2^nd, 2019 and most recently updated on March 11^th, 2020. The new information includes updated mitigation information for:

• ION7400 MID; and

• PM8000 MID

Schneider has published an update for their Modicon Controllers advisory that was originally published on November 12^th, 2019. The new information includes the addition of a new hard-coded credentials vulnerability - CVE-2019-6859.

Schneider has published an update for their Andover Continuum advisory that was originally published on March 10^th, 2020. The updated information includes an explanation that the code injection vulnerability is a third-party MS-XML library vulnerability.

Schneider has published an update for their Modicon Controllers advisory that was originally published on December 10^th, 2019. The updated information includes:

• Adding Modicon M340 and M580 to affected product list;

• Adding a hotfix link and adding further details to the mitigation measures;

• Adding updated firmware links; and

• Adding Enrique Murias Fernández of Tecdesoft Automation to the acknowledgements.

Siemens Updates

Siemens published an update for an advisory for Intel CPUs that was originally published on February 11^th, 2020 and most recently updated on March 10^th, 2020. The new information includes updated version information and mitigation links for SIMATIC ET 200SP Open Controller CPU 1515SP PC2.

Siemens published an update for an advisory for Industrial Products that was originally published on January 14^th, 2020. The new information includes explicitly mentioning old versions of SIMATIC NET.

Siemens published an update for their GNU/Linux subsystem vulnerabilities advisory that was originally published on November 27^th, 2018 and most recently updated on February 11^th, 2020. The new information includes adding the following new vulnerabilities:

• CVE-2015-5895;

• CVE-2019-19447;

• CVE-2019-19603;

• CVE-2019-19645,

• CVE-2019-19646;

• CVE-2019-19880;

• CVE-2019-19923;

• CVE-2019-19924;

• CVE-2019-19925;

• CVE-2019-19926;

• CVE-2019-19959;

• CVE-2019-20218;

• CVE-2020-8428;

• CVE-2020-8492;

• CVE-2020-9327;

• CVE-2020-10029; and

• CVE-2020-10942

Siemens published an update for their SIMATIC advisory that was originally published on July 30^th, 2012. The new information includes adding SIPLUS devices to the list of affected devices.

NOTE: ICS-CERT published advisory ICSA-12-212-02 covering this vulnerability, but has not yet updated (and may not update) that advisory.

Siemens published an update for their SIMATIC advisory that was originally published on July 30^th, 2012. The new information includes adding SIPLUS devices to the list of affected devices.

NOTE: This advisory was lumped into the ICS-CERT advisory described above.

Public ICS Disclosures – Week of 3-7-20 Part II

In addition to the vendor disclosures I discussed yesterday, we have four vendor disclosures from Schneider and three updated disclosures from Schneider and Siemens (2).

Schneider Advisories

Schneider published an advisory describing two vulnerabilities in the Schneider Interactive Graphical SCADA System (IGSS). The vulnerabilities were reported by an anonymous researcher via the Zero Day Initiative. Schneider has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper limitation of a path name to a restricted directory - CVE-2020-7478; and

• Missing authentication for a critical function - CVE-2020-7479

Schneider published an advisory describing an improper check for unusual or exceptional conditions vulnerability in the Schneider Modicon Quantum Ethernet Network module and Quantum / Premium COPRO. The vulnerability was reported by China Information Technology Security Evaluation Centre (CNITSEC). Schneider has a new version for the Quantum Ethernet Network module that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing an untrusted search path vulnerability in the Schneider ZigBee Installation Toolkit. The vulnerability was reported by Yongjun Liu of nsfocus. Schneider has a new version that mitigates the vulnerability. There is no indication that Liu has been provided an opportunity to verify the efficacy of the fix.

Schneider published an advisory describing three vulnerabilities in the Schneider Andover Continuum Line of Controllers. The vulnerabilities were reported by Niv Levy. Schneider provided generic mitigation measures for this product that is no longer under service support.

Schneider Update

Schneider has published an update for their Urgent/11 advisory that was originally published on August 2^nd, 2019 and most recently updated on February 11^th, 2020. The new information includes mitigation measures for:

• HMIGXU;

• Easergy MiCOM P30;

• Tricon Communication Modules; and

• Trident Communication Integration Module

Siemens Updates

Siemens published an update for an advisory for Intel CPUs that was originally published on February 11^th, 2020. The new information includes updated version and mitigation data for:

• SIMATIC IPC127El;

• SIMATIC IPC627E;

• SIMATIC IPC647E;

• SIMATIC IPC677E; and

• SIMATIC IPC847E

Siemens published an update for an advisory for their ZombieLoad advisory that was originally published on July 9^th, 2019 and most recently updated on February 11^th, 2020. The new information includes updated version and mitigation data for:

• SIMATIC IPC127E; and

• SIMATIC IPC527G

Public ICS Disclosure – Week of 2-7-20

This week we have eight vendor disclosures for products from Siemens (2), Schneider Electric, Phoenix Contact, HMS, ABB (2) and Moxa. We also have three advisory updates from Siemens and one from Schneider.

Siemens Advisories

Siemens published an advisory describing three vulnerabilities found in Intel chips used in Siemens products. The vulnerabilities were identified and reported (advisory links below) by Intel. Siemens has provided generic workarounds to mitigate the vulnerabilities.

The three reported vulnerabilities are:

• Insufficient memory protection (2) - CVE-2019-0151 and CVE-2019-0152; and

• Heap-based buffer overflow - CVE-2019-0169

Siemens published an advisory describing a resource allocation vulnerability in their Profinet-IO stack. The vulnerability was reported by Yuval Ardon and Matan Dobrushin from OTORIO. Siemens has updates that mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Schneider Advisory

Schneider Published an advisory describing an uncontrolled search path element vulnerability in their ProSoft Configurator. The vulnerability was reported by Yongjun Liu from nsfocus. Schneider has a new version that mitigates the vulnerability. There is no indication that Yongiun has been provided an opportunity to verify the efficacy of the fix.

Phoenix Contact Advisory

Phoenix Contact has published an advisory [.PDF download link] describing a remote configuration vulnerability in their Emalytics Controllers. The vulnerability was reported by Anil Parmar. Phoenix Contact has a new firmware version that mitigates the vulnerability. There is no indication that Parmar has been provided an opportunity to verify the efficacy of the fix.

HMS Advisory

HMS has published an advisory describing a cross-site scripting vulnerability in their Flexy and Cosy products. The vulnerability was reported by Ander Martínez from Titanium Industrial Security. HMS has a new firmware version that mitigates the vulnerability. There is no indication that Martinez has been provided an opportunity to verify the efficacy of the fix.

ABB Advisories

ABB published an advisory describing a direct object reference vulnerability in their Asset Suite product. The vulnerability is self-reported. ABB has a new version that mitigates the vulnerability.

ABB published an advisory describing 14 vulnerabilities in their eSOMS product. The vulnerabilities are self-reported. ABB has a new version that mitigates the vulnerabilities.

Moxa Advisory

Moxa published an advisory describing 8 vulnerabilities in their OnCell cellular gateway. The vulnerabilities were reported by Alexander Zaytsev from Kaspersky Lab. Moxa has new firmware versions that mitigate the vulnerabilities. There is no indication that Zaytsey has been provided an opportunity to verify the efficacy of the fix.

Siemens Updates

Siemens published an update to their  Linux TCP SACK PANIC advisory for Industrial Products that was originally published on September 10^th, 2019 and most recently updated on November 14^th, 2019. The new information includes revised version data and mitigation links for:

• TIM 1531 IRC;

• SIMATIC CP 1242-7, CP 1243-7 LTE (EU andUS versions), CP 1243-1, CP 1243-8 IRC, CP 1543-1, CP 1542SP-1, CP 1542SP1 IRC, CP 1543SP-1; and

• SCALANCE W1700.

NOTE: NCCIC-ICS updated their advisory on February 11^th, but did not list it on their web site.

Siemens published an update for their ZombieLoad advisory that was originally published on July 9^th, 2019 and most recently updated on December 10^th, 2019. The new information includes updated version data and mitigation links for:

• SIMATIC IPC547E;

• SIMATIC IPC347E; and

• SIMATIC IPC3000 SMART V2

Siemens published an update for their GNU/Linux subsystem vulnerabilities advisory that was originally published on November 27^th, 2018 and most recently updated on January 14^th, 2020. The new information includes adding the following new vulnerabilities;

• CVE-2019-5188;

• CVE-2019-11190;

• CVE-2019-19956;

• CVE-2019-20054,

• CVE-2019-20079;

• CVE-2019-20388; and

• CVE-2020-7595

Schneider Update

Schneider published an update for their U.motion Builder advisory that was originally published on April 5^th, 2018. The new information includes an updated remediation section.

1 Advisory Published – 10-22-19

Today he CISA NCCIC-ICS published a control system security advisory for products from Schneider

Schneider Advisory

This advisory describes three vulnerabilities in the Schneider ProClima building and automation control products. The vulnerabilities were reported by Haojun Hou, Kushal Arvind Shah, Fortinet, Yongjun Liu, NSFOCUS, and Telus. Schneider has released a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Code injection - CVE-2019-6823;

• Improper restriction of operations within the bounds of a memory buffer - CVE-2019-6824; and

• Uncontrolled search path element - CVE-2019-6825

NCCIC-ICS reported that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system.

NOTE: According to the Schneider advisory these vulnerabilities were reported on June 11^th, and I briefly reported on them on June 15^th. What NCCIC-ICS is actually addressing is an update to the original advisory that adjusted the CVSS Base Score and Vector for CVE2019-6823 and CVE-2019-6824.

Public ICS Disclosures – Week of 08-10-19

This week we have eight vendor notifications from Schneider (7) and Siemens; updates for four previouls published advisories from Schneider (2) and Siemens (2); as well as two exploit reports for previously published vulnerabilities in products from Wind River, and Cisco.

Schneider Advisories

Magelis Advisory

Schneider published an advisory describing an improper check for unusual or exceptional conditions vulnerability in their Magelis HMI Panel products. The vulnerability was reported by VAPT Team. Schneider provides generic workarounds to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Modicon 340 Advisory

Schneider published an advisory describing an improper check for unusual or exceptional conditions vulnerability in their Modicon M340 controllers. The vulnerability was reported by VAPT Team. Schneider provides generic workarounds to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Modicon Advisory

Schneider published an advisory describing three improper check for unusual or exceptional conditions vulnerabilities in their Modicon Ethernet / Serial RTU Modules. The vulnerability was reported by VAPT Team. Schneider provides generic workarounds to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

SoMachine Advisory

Schneider published an advisory describing an untrusted search path vulnerability in their SoMachine HVAC. The vulnerability was reported by Yongjun Liu of the nsfocus security team. Schneider has a new version that mitigates the vulnerability. There is no indiction that Yonguin has been provided an opportunity to verify the efficacy of the fix.

TelevisGo Advisory

Schneider published an advisory describing 22 vulnerabilities in the third party UltraVNC (remote accesss) software component embedded within the TelevisGo product. The vulnerabilities were reported by Kaspersky Labs. Schneider has a hot-fix available that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The 22 reported vulnerabilities are:

• Buffer errors (9) - CVE-2019-8258, CVE-2018-15361, CVE-2019-8262, CVE-2019-8263, CVE-2019-8269, CVE-2019-8271, CVE-2019-8273, CVE-2019-8274, and CVE-2019-8276;

• Resource management errors (2) - CVE-2019-8259, and CVE-2019-8277;

• Out-of-bounds read (8) - CVE-2019-8260, CVE-2019-8261, CVE-2019-8280, CVE-2019-8264, CVE-2019-8265, CVE-2019-8266, CVE-2019-8267, and CVE-2019-8270;

• Incorrect calculation (2) - CVE-2019-8268, CVE-2019-8272; and

• Improper access control - CVE-2019-8275.

Software Update Service Advisory

Schneider published an advisory describing a deserialization of trusted data vulnerability in their Software Update (SESU) SUT Service. The vulnerability was reported by Amir Preminger of Claroty. Schneider has a new version that mitigates the vulnerability. There is no indication that Preminger has been provided an opportunity to verify the efficacy of the fix.

spaceLYnk Advisory

Schneider published an advisory describing an authentication vulnerability in their  spaceLYnk and Wiser for KNX controllers. The vulnerability was reported by Sumedt Jitpukdebodin. Schneider has new versions that mitigate the vulnreabilty. There is no indication that Jitpukdebodin has been provided an opportunity to verify the efficacy of the fix.

Schneider Updates

Modicon Controllers Update

Schneider published an update that was originally published on May 14^th, 2019.  New information includes:

Added mitigation measures for M340;

Added four new vulnerabilities (links for reports w/exploits from Talos):

• Denial of service vulnerability - CVE-2019-6809;

• Denial of service vulnerability - CVE-2019-6828;

• Denial of service vulnerability - CVE-2019-6829; and

• Denial of service vulnerability - CVE-2019-6830

SCADAPack Update

Schneider published an update for an advisory that was originally published on May 24^th, 2017. New information includes:

• Updated researcher acknowledgement section;

• Corrected CVE ID from CVE-2017-6028 to CVE-2017-6034; and

• Corrected vulnerability description

Siemens Advisory

Siemens published an advisory describing two vulnerabilities in their SIMATIC S7-1200 and SIMATIC

S7-1500 CPU families.  The vulnerabilities were reported by Eli Biham, Sara Bitan, Aviad Carmel, and Alon Dankner, Uriel Malin, and Avishai Woo. Siemens has generic workarounds that mitigate the vulenrabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Man-in-the-middle vulnerability - CVE-2019-10929; and

• Code change vulnerability - CVE-2019-10943

Siemens Updates

ZombieLoad Update

Siemens published an update for an advisory that was originally published on July 9^th, 2019. New information includes:

• SIMATIC IPCs 427D, 477D, 627D, 627E, 647D, 647E, 677D, 677E, 827D, 847D, 847E; and

• FieldPG M6

GNU/Linux Update

Siemens published an update for an advisory that was originally published on November 27^th, 2019. New information includes:

• Added CVE-2018-19591, CVE-2019-11360, CVE-2019-13272; and

• Moved CVE2018-16862 from buildtime to runtime relevant

Cisco Exploit

Angelo Ruwantha published a Metasploit module for a vulnerability in the Cisco Adaptive Security Appliance; Cisco published an advisory on this vulnerability on June 6thy, 2018. NCCIC-ICS published an advisory for Rockwell Automation Allen-Bradley Stratix 5950 listing this vulnerability.

WindRiver (Urgent/11) Exploit

Zhou Yu published an exploit for an integer overflow vulnerability in the Wind River VxWorks (one of the Urgent/11 vulnerabilities).

Public ICS Disclosure – Week of 06-08-19

This week we have two new vendor notifications from Schneider and 18 researcher reports from Talos of vulnerabilities in products from Schneider. We also have four updated notifications from Schneider (2) and Siemens (2). Additionally, we have two vendor updates for advisories about the Microsoft® RDP vulnerability from Philips and Drager.

Schneider Advisories

1. Schneider published an advisory for a credential exposure vulnerability in the Schneider PowerSCADA Expert product (NOTE: According to Schneider this also affects the AVEVA CitecSCADA, but no AVEVA advisory has yet been published). This vulnerability is apparently self-reported. Schneider has a new version that mitigates the vulnerability.

2. Schneider published an advisory for three vulnerabilities in the Schneider ProClima product. The vulnerabilities were reported by Kushal Arvind Shah (Fortinet), Telus, and Haojun Hou and

Yongjun Liu (NSFOCUS). Schneider has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Code injection - CVE-2019-6823;

• Buffer errors - CVE-2019-6824; and

• Uncontrolled search path element - CVE-2019-6825

Talos Reports on Schneider Vulnerabilities

Talos has provided reports with exploits on 18 vulnerabilities in two products from Schneider; Modicon 580 UMAS and UnityPro PLC. These are coordinated disclosures, but Schneider has not yet published advisories for these vulnerabilities. Because of the volume I am not going to attempt to go into details.

Modicon 580 UMAS

• Information disclosure - CVE-2018-7845;

• Denial of service - CVE-2018-7854;

• Denial of service - CVE-2018-7853;

• Denial of service - CVE-2018-7849;

• Improper authentication - CVE-2018-7842;

• Unauthenticated file write - CVE-2018-7847;

• Denial of service - CVE-2018-7855;

• Denial of service - CVE-2019-6807;

• Denial of service - CVE-2018-7856;

• Information disclosure - CVE-2018-7844;

• Information disclosure - CVE-2019-6806;

• Information disclosure - CVE-2018-7848;

• Denial of service - CVE-2018-7852;

• Denial of service - CVE-2018-7846;

• Denial of service - CVE-2018-7857; and

• Denial of service - CVE-2018-7843

UnityPro

• Remote code execution - CVE-2019-6808;

• Untrusted inputs - CVE-2018-7850;

NOTE: There are still 10 reports pending on Schneider vulnerabilities on the Talos Zeroday Reports web page. Someone has been spending a great deal of time testing Schneider equipment.

Schneider Updates

1. Schneider updated an advisory for the Schneider Embedded Web Servers for Modicon V2 (Note: this has not been reported by NCCIC-ICS). The new information is the addition of researcher acknowledgements.

2. Schneider updated an advisory for the Schneider – U.motion Builder software (Note: this has not been reported by NCCIC-ICS). Schneider is reporting that this vulnerability has been exploited by Mirai malware. Schneider is making an unusual recommendation: “It is imperative customers cease using U.motion Builder software and remove it from their systems immediately.”

Siemens Updates

1. Siemens updated an advisory for Foreshadow/L1 terminal fault vulnerabilities in Industrial Products (Note: this has not been reported by NCCIC-ICS). The new information is added mitigation measures for:

• SIMATIC S7-1500 Software Controller;

• SIMATIC ET 200 SP Open Controller; and

• SIMATIC ET 200 SP Open Controller (F)

2. Siemens updated an advisory for Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU. The update adds information for new firmware V2.6.1

RDP Vulnerability

Two vendor advisories were updated this week:

• Philips; and

• Drager