Today, CISA’s NCCIC-ICS published three control system security advisories for products from Rittal, Baicells, and Mitsubishi. They also published a medical device security advisory for products from Medtronic. They updated a control system security advisory for products from Mitsubishi.
Rittal Advisory
This advisory describes an improper access control vulnerability in the Rittal CMC III locks. The vulnerability was reported by Alpha Strike Labs by Limes Security. The CMC III and the CMC compact products are end-of-life and no longer supported.
NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to clone access cards used to open control cabinets secured with Rittal CMC III locks.
Baicells Advisory
This advisory described a command injection vulnerability in the Baicells LTE TDD eNodeB devices. The vulnerability was reported by Rustam Amin. Baicells has a new version that mitigates the vulnerability. There is no indication that Amin has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow commands performed using pre-login execution and with root permissions.
NOTE: I briefly discussed the vulnerability on February 11th, 2023.
Mitsubishi Advisory
This advisory describes a plain-text storage of a password vulnerability in the Mitsubishi Electric MELSEC iQ-F products. The vulnerability was reported by JeongHoon Bae, YiJoon Jung, JinYoung Kim, HyeokJong Yun, and HeeA Go of HelloT. Mitsubishi provides generic mitigation measures.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthenticated malicious actor to login to a file transfer protocol (FTP) server or web server by obtaining plaintext credentials stored in project files.
Medtronic Advisory
This advisory describes an unverified password change vulnerability in the Medtronic Micros Clinician (A51200) app and InterStim X Clinician (A51300). The vulnerability is self-reported. Medtronic has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to cause the clinician application’s custom password to be reset to default, resulting in unauthorized control of the clinician therapy application.
Mitsubishi Update
This update provides additional information on an advisory that was originally published on July 30th, 2020 and most recently updated on November 22nd, 2022. The new information includes adding Position Board utility 2 to the list of affected products. The Mitsubishi advisory update reports a fix for this product. NCCIC-ICS is not reporting individual product fixes on this advisory, instead it refers to the Mitsubishi advisory.
NOTE: This is not the Mitsubishi update that I mentioned on Tuesday.