Review – 5 Advisories Published – 2-10-26

Today CISA’s NCCIC-ICS published four control system security advisory for products from AVEVA (2), ZLAN Information Technology, and Yokogawa. They also published a medical device security advisory for products from ZOLL.

 

Advisories

 

AVEVA Advisory #1 - This advisory describes an insertion of sensitive information into a log file vulnerability in the AVEVA PI to CONNECT Agent.

AVEVA Advisory #2 - This advisory describes an uncaught exception vulnerability in the AVEVA PI Data Archive.

ZLAN Advisory - This advisory describes two missing authentication for critical function vulnerabilities in the ZLAN ZLAN5143D.

Yokogawa Advisory - This advisory describes 14 vulnerabilities in the Yokogawa FAST/TOOLS product.

ZOLL Advisory - This advisory describes an insertion of sensitive information into externally-accessible file or directory vulnerability in the ZOLL ePCR IOS Mobile Application.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-published-2-10-26 - subscription required.

Is something going on with ZOLL Defibrillators?

Okay, this probably does not mean anything, but something odd is going on with the recent advisory about the vulnerabilities in the ZOLL Defibrillator Dashboard. As I reported last week CISA’s NCCIC-ICS published a medical device security advisory describing five vulnerabilities in the Defibrillator Dashboard from ZOLL.

According to the advisory from NCCIC-ICS, ZOLL has new versions available to mitigate the vulnerability. On the surface the only odd thing about the advisory was that the vulnerabilities were reported to CISA by an anonymous researcher. One could speculate about why the researcher wanted to remain anonymous, but at this point it would be just speculation. In any case, NCCIC-ICS reported the vulnerabilities to ZOLL, ZOLL corrected the problems, NCCIC-ICS published the advisory. Nothing unusual here.

Then, yesterday, CISA published an advisory about the same vulnerabilities, pointing at the NCCIC-ICS advisory. No new information, just the point and a recommendation that:

“CISA encourages users and administrators to review the ICS Medical Advisory ICSMA-21-161-01 and apply the recommended mitigations.”

I thought that that was a little bit odd, CISA issuing an advisory pointing at an earlier CISA advisory with no new information, but I did not really start to get curious until I saw the following TWEET® from @ICS-CERT this morning:

“ICYMI

⚠️

@CISAgov recently released an #ICS Medical Advisory on multiple vulnerabilities in the ZOLL Defibrillator Dashboard. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

#VulnerabilityManagement #OT #IoT #Healthcare”

Obviously, someone at CISA thinks that these vulnerabilities are unusually important. So, maybe there are exploits in the wild? I search both cve.mitre.org and nvd.nist.gov for the six reported CVEs and get nothing; the CVE has been reserved, but no data has been given to either organization yet. This is not really unusual, it may take as much as a week from the time NCCIC-ICS publishes an advisory for the CVE information to make it into the National Vulnerability Database.

Okay, so next I do a Google® search for the ZOLL Defibrillator Dashboard to see if there are any news articles about problems. No problems found there. But I did see almost nine pages of reference to unrelated articles on Homeland Security Today, dating back to January. Why? Because each article currently has the same ‘You Might Be Interested’ text box at the bottom:

“JUNE 14, 2021

CISA Releases Advisory on ZOLL Defibrillator Dashboard

“CISA has released an Industrial Controls Systems (ICS) Medical Advisory on multiple vulnerabilities in the ZOLL Defibrillator Dashboard. A remote…”

That text box refers back to the short article on the site that refers back to yesterday’s CISA advisory. Except that most of those pages no longer have that text box; Homeland Security Today keeps changing what boxes show up on the bottom of their pages to keep people flowing back to their web site. Good internal SEO work.

Oh, nothing on the FDA’s medical device cybersecurity page, but they have not reported on a vulnerability since 2019, so nothing new there (in both ways of looking at that phrase). And nothing on the ZOLL webpages, but lots of companies ignore their cyber vulnerabilities, so nothing too unusual with that.

In any case, I still cannot tell why CISA is so concerned about the ZOLL Defibrillator Dashboard…. If you have one, just update it, please.

3 Advisories Published – 6-10-21

Today CISA’s NCCIC-ICS published two control system security advisories for products from AGG Software and Rockwell Automation. They also published a medical device security advisory for products from ZOLL.

AGG Advisory

This advisory describes two vulnerabilities in the AGG Web Server. The vulnerabilities were reported by Michael Heinzl. AGG has a new version that mitigates the vulnerabilities. There is no indication that Heinzl has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow remote code execution and exposure of arbitrary system files.

Rockwell Advisory

This advisory describes a protection mechanism failure vulnerability in the Rockwell  FactoryTalk Services Platform. The vulnerability is self-reported. Rockwell has a new version that mitigates the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow remote, authenticated users to bypass FactoryTalk Security policies that are based on a computer name.

ZOLL Advisory

This advisory describes six vulnerabilities in the ZOLL Defibrillator Dashboard. The vulnerabilities were reported anonymously to CISA. ZOLL has new versions that mitigate the vulnerabilities.

The six reported vulnerabilities are:

• Unrestricted upload of file with dangerous type - CVE-2021-27489,

• Use of hard-coded cryptographic key - CVE-2021-27481,

• Cleartext storage of sensitive information - CVE-2021-27487,

• Cross-site scripting - CVE-2021-27479

• Storing passwords in a recoverable format - CVE-2021-27485, and

• Improper privilege management - CVE-2021-27483

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow remote code execution, allow an attacker to gain access to credentials, or impact confidentiality, integrity, and availability of the application.