Today, CISA’s NCCIC-ICS published five control system security advisories for products from Elcomplus (2), FANUC, and Carrier (2). They also updated their advisory for multiple RTOS products.
Elcomplus Advisory #1
This advisory describes five vulnerabilities in the Elcomplus SmartPPT SCADA Server integrated voice and data dispatch software. The vulnerabilities were reported by Michael Heinzl. Elcomplus has an update to mitigate the vulnerability. There is no indication that Heinzl has been provided an opportunity to verify the efficacy of the fix.
The five reported vulnerabilities are:
Cross-site scripting - CVE-2021-43932,
Information exposure - CVE-2021-43938,
Unrestricted upload of file with dangerous type - CVE-2021-43934,
Path traversal - CVE-2021-43930, and
Cross-site request forgery - CVE-2021-43937
NCCIC-ICS reported that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthorized user to store dangerous data in a trusted database; potentially exposing sensitive information; allow malicious users to upload arbitrary files; provide attackers a way to traverse the file system to access files or directories that are outside of the restricted directory; or result in exposure of data or unintended code execution.
Elcomplus Advisory #2
This advisory describes four vulnerabilities in the Elcomplus SmartPPT SCADA integrated voice and data dispatch software. The vulnerabilities were reported by Michael Heinzl. Elcomplus has an update to mitigate the vulnerability. There is no indication that Heinzl has been provided an opportunity to verify the efficacy of the fix.
The four reported vulnerabilities are:
Cross-site scripting - CVE-2021-43932,
Improper authorization - CVE-2021-43939,
Unrestricted upload of file with dangerous type - CVE-2021-43934, and
Path traversal - CVE-2021-43930
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to provide attackers a way to traverse the file system to access files or directories that are outside of the restricted directory; allow the upload or transfer files of dangerous types that can be automatically processed within the product's environment; allow an unauthorized access to an action or a resource; or allow a user to store dangerous data in a trusted database.
FANUC Advisory
This advisory describes five vulnerabilities in the FANUC ROBOGUIDE simulation platform software suite for FANUC Robots. The vulnerabilities were reported by Sharon Brizinov with Claroty. FANUC has a new version that mitigates the vulnerability. There is no indication that Sharon has been provided an opportunity to verify the efficacy of the fix.
The five reported vulnerabilities are:
Incorrect permission assignment for critical resource - CVE-2021-38483,
Improper access control - CVE-2021-43986,
Path traversal - CVE-2021-43988,
Improper restriction of XML element entity reference - CVE-2021-43990, and
Uncontrolled resource consumption - CVE-2021-43990
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to cause a denial-of-service condition, allow for remote code execution, or provide unauthorized privilege escalation.
NOTE: On April 9th, 2022, I briefly reported on a FANUC advisory that reported two of the above CVE’s (CVE-2021-38483 and CVE-2021-43986). There was no vulnerability description provided in their advisory, so it is hard to tell if the other three vulnerabilities with ‘2019’ CVE numbers are the same as the ‘2021’ numbers reported here.
Carrier Advisory #1
This advisory describes an open redirect vulnerability in the Automated Logic (subsidiary of Carrier) WebCtrl Server building automation software products. The vulnerability was reported by Chizuru Toyama of TXOne IoT/ICS Security Research Labs via the Zero Day Initiative. Carrier has a new version that mitigates the vulnerability. There is no indication that Toyama has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to redirect the user to a malicious webpage or to download a malicious file.
Carrier Advisory #2
This advisory describes two vulnerabilities in the Interlogix (subsidiary of Carrier) Hills ComNav remote access integration modules for the Hills Reliance security alarm system. The vulnerabilities were reported by Jacob Thompson of Flinders University, Dr. Paul Gardner-Stephen of Flinders University and DEWC Systems, and Dr. Samuel Chenoweth of Defence Science and Technology Group. Carrier has new firmware versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Improper restriction of excessive authentication attempts - CVE-2022-26519, and
Inadequate encryption strength - CVE-2022-1318
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to log in to modify the system.
NOTE: The Carrier advisory lists two additional vulnerabilities:
Unencrypted communication (CWE-311), and
Predictable message size (CWE-342)
Multiple RTOS Update
This update provides additional information on an advisory that was originally published on April 29th, 2021 and most recently updated on November 30th, 2021. The new information includes links to advisories for the Hitachi Energy products:
GMS600,
PWC600, and
REB500
NOTE: I briefly reported on these three advisories on December 18th, 2021.