Today, CISA’s NCCIC-ICS published two control system security advisories for products from WIBU and Hitachi ABB Power Grids. They also published an update for an advisory for products from Mitsubishi.
WIBU Advisory
This advisory describes two buffer over-read vulnerabilities in the WIBU CodeMeter Runtime Server. The vulnerabilities were reported by Tenable. This report contains proof-of-concept code. WIBU has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe).
NOTE: I briefly discussed these vulnerabilities back in June.
Hitachi ABB Advisory
This advisory describes an insufficiently protected credentials vulnerability in the Hitachi ABB Power Grids eSOMS product. The vulnerability was self-reported. Hitachi ABB has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow access to user credentials that are stored by the browser.
NOTE: I briefly discussed this vulnerability earlier this month.
Mitsubishi Update
This update provides additional information on an advisory that was originally published on February 18th, 2021 and most recently updated on May 27th, 2021. The new information includes adding mitigation measures for:
GX Developer, and
MELSOFT Navigator.
NOTE 1: The NCCIC-ICS advisory lists 2-18-21 as the latest publication date, but an update was published on May 27th.
NOTE: 2: I mentioned this advisory in passing last Tuesday.