Today, CISA’s NCCIC-ICS published a control system security advisory for products from Nexx Smart.
Nexx Smart Advisory
This advisory describes five vulnerabilities in a variety of Nexx Smart Home devices. The vulnerabilities were reported by Sam Sabetan. Nexx Smart has not responded to requests for working with CISA on mitigating the vulnerabilities.
The five reported vulnerabilities are:
Use of hard-coded credentials - CVE-2023-1748,
Authorization bypass through user-controlled key - CVE-2023-1749 and CVE-2023-1750,
Improper input validation - CVE-2023-1751, and
Improper authentication - CVE-2023-1752
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to receive sensitive information, execute application programmable interface (API) requests, or hijack devices.
Commentary
We are seeing an increasing number of these advisories that are for devices not related to industrial, transportation, or medical devices. While it is easy to criticize CISA for publishing these reports, with the time and personnel resources required to coordinate their disclosure, these are operational technology and security technology devices, so there is some justification for CISA’s coverage. This is especially true when you consider that there is no other federal agency that would deal with the reporting and disclosure coordination for these IoT devices.
Congress is going to have to determine if this is a legitimate use of CISA resources. If it is (and I think there are legitimate arguments on both sides of the question) then Congress is going to have to increase the resources available for vulnerability coordination and disclosure. That is probably not going to happen in this session.
A more important question for researchers and CISA is whether or not this particular set of vulnerabilities is the result of poor coding practices at Nexx (if Nexx actually doe their own product development) or if these vulnerabilities are an inherent problem in the controllers and communications systems used by these devices. With Nexx refusing to coordinate with CISA there is no easy way for the government to determine if these are institutional or inherent problems (or more likely some combination of the two).
If this question is important (and I believe that it is), then CISA, or some national laboratory, is going to either have to rely on information from reporting researchers and vendors to make the determination, or there will have to be a real research capability added to the vulnerability coordination-disclosure process to make that determinations. That will cost an even larger (much larger) budget and personnel allocation to the process. I do not see that happening anytime soon.
Without a significant expansion of funding, CISA is going to need some additional authority to order vendors to comply with information requests about reported vulnerabilities if they are going to be truly effective in the coordinated disclosure of vulnerabilities in an expanded scope of industrial, medical, security and IoT devices.