Today CISA’s NCCIC-ICS published three control system security advisories for products from Advantech, JTEKT, and Johnson Controls.
Advantech Advisory
This advisory describes a stack-based buffer overflow vulnerability in the Advantech WebAccess HMI platform. The vulnerability was reported by Natnael Samson via the Zero Day Initiative. Advantech has a new version that mitigates the vulnerability. There is no indication that Samson was provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow remote code execution.
JTEKT Advisory
This advisory describes an allocation of resources without limits or throttling vulnerability in the JTEKT TOYOPUC PLCs. The vulnerability was reported by Yenting Lee of Trend Micro via ZDI. JTEKT has provided generic work arounds for this vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could exploit this vulnerability to allow a remote attacker to deny Ethernet communications between affected devices without authorization.
Johnson Controls
This advisory describes an off-by-one error vulnerability in the Johnson Controls (Sensormatic subsidiary) Illustra camera systems. This is a third-party (Sudo) vulnerability with multiple exploits published (see here, here and here for example). Johnson Controls has new versions that mitigate the vulnerability for three of the four affected products. The fourth product is end-of-life, and no mitigation measures or workarounds are provided in the Johnson Controls advisory.
NCCIC-ICS reports that a relatively low-skilled attacker could exploit the vulnerability to allow a local attacker to obtain super user access to the underlying Linux operating system.