Today, CISA’s NCCIC-ICS published two control system security advisories for products from SystemK and MachineSense. I also briefly discuss the possible expansion of the affected products for the MachineSense advisory.
SystemK Advisory
This advisory describes a command injection vulnerability in the SystemK network video recorders. The vulnerability was reported by Keniver Wang, the report includes proof-of-concept code (PoC). CISA reports that: “SystemK has not responded to requests to work with CISA to mitigate this vulnerability.”
NCCIC-ICS reports that a relatively low-skilled attacker could use publicly available PoC to remotely exploit the vulnerability to allow an attacker to execute commands with root privileges.
MachineSense Advisory
This advisory describes six vulnerabilities in the MachineSense FeverWarn products. The vulnerability was reported by Vera Mens of Claroty Research. FeverWarn and its associated cloud service is a legacy pandemic product that is no longer under support.
The six reported vulnerabilities are:
Missing authentication for critical function - CVE-2023-6221,
Use of hard-coded credentials - CVE-2023-46706,
Missing authentication for critical function (2) - CVE-2023-49617 and CVE-2023-49115,
Improper access control - CVE-2023-47867, and
Improper input validation - CVE-2023-49610
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to obtain user data from devices, execute remote code on devices, or gain control over devices to perform malicious actions.
NOTE: The vulnerability description in the advisory for the first vulnerability mentions other MachineSense devices (“the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others”) as being affected by the vulnerability based on the use of the cloud service. The second vulnerability descriptions references “Multiple MachineSense devices” which may(?) include devices beyond the FeverWarn device. And the third vulnerability refers to the “MachineSense application programmable interface (API)”, which may(?) be used for non-FeverWarn devices. I cannot tell if I am just reading things into these vague descriptions or if other (not just legacy pandemic) MachineSense products are affected. Unfortunately, the CVE’s have not yet been published for these six vulnerabilities, so we cannot check the listed CPE’s to see if other products are affected; and the Claroty report has not yet been published.