1 Advisory Published – 2-7-23

Today, CISA’s NCCIC-ICS published one control system security advisory for products from EnOcean.

EnOcean Advisory

This advisory describes a use of hard-coded credentials in the EnOcean Edge SmartServer with iLON Vision. The vulnerability was reported by Chizuru Toyama of Trend Micro. EnOcean has a new version that mitigates the vulnerability. There is no indication that Toyama has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to gain unauthorized access to the servers.

Down-the-Rabbit-Hole: iLON Vision?

The iLON Vision product referenced in this advisory is a third-party (Johnson Controls) product used for the generation of web pages used in process control operations. Today’s advisory implies that the current version of the iLON Vision product with the SmartServer is a prerequisite for the vulnerability to exist:

“The affected product, Echelon SmartServer 2.2 with i.LON Vision 2.2, stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer.”

But, the advisory lists this vulnerability as a ‘use of hard-coded credentials’ vulnerability (CWE 798). The clear-text storage of credentials is a different CWE, ‘Storing Passwords in a recoverable format’ (CWE 257)

Now if this were CWE 789, then that would mean that the exchange of credentials between the two products includes a hard-coded credential. It is not clear from this advisory which product contains the hard-coded credential, but it is obvious that that credential is recognized by the other program.

In that case today’s advisory notes that OnOcean updated their software. If that change removed the password from SmartServer, the Vision program could possibly still recognize/accept the password, even when used with other products. If the SmartServer change stopped the program from recognizing the specific hard-coded password from the Vision program, then that password probably still exists in the Johnson Controls program.

On the other hand, if this is actually CWE 257, then the SmartServer program would be storing the open text credentials, and fixing that program fixes the vulnerability and no other program is affected.

Let’s hope that NCCIC-ICS (or perhaps Trend Micro in their report to CISA) made a mistake in assigning CWE’s and the fix is in…