Today, CISA’s NCCIC-ICS published three control system security advisories for products from IDEC, Fernhill and Omron. They also published a medical device security advisory for products from Philips.
IDEC Advisory
This advisory describes four vulnerabilities in the IDEC PLC’s. The vulnerabilities were reported by Khalid Ansari of FM Approvals. IDEC has new versions that mitigate the vulnerability. There is no indication that Ansari has been provided an opportunity to verify the efficacy of the fix.
The four reported vulnerabilities are:
Unprotected transport of credentials - CVE-2021-37400 and CVE-2021-20826, and
Plain-text storage of password - CVE-2021-37401 and CVE-2021-20827
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to upload, alter, and/or download the PLC user program. An attacker could also access the PLC web server and hijack the controllers, resulting in the manipulation and/or suspension of the PLC output.
NOTE 1: I briefly reported on these vulnerabilities on December 25th, 2021.
NOTE 2: Interestingly, the CNA for the -374XX CVEs was MITRE and for the -208XX CVE’s it was JPCERT. Thus, we may only have two vulnerabilities with duplicate reporting. Not that it makes any real difference
Fernhill Advisory
This advisory describes an uncontrolled resource consumption vulnerability in the Fernhill SCADA Server. The vulnerability was reported by ExCraft. Fernhill has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition.
Omron Advisory
This advisory describes a stack-based buffer overflow vulnerability in the Omron CX-One automation software. The vulnerability was reported by xina1i vis the Zero Day Initiative. Omron has a new version that mitigates the vulnerability. There is no indication the xina1i has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit this vulnerability to allow arbitrary code execution.
Philips Advisory
This advisory describes an improper access control vulnerability in the Philips Engage customer support software platform. The vulnerability was reported by Parnassia and S-Unit. Philips released and deployed an updated version in September to mitigate this vulnerability. There is no indication that the researchers have been provided with an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow improper viewing (read-only) of business contact information.