Today, CISA’s NCCIC-ICS published five control system security advisories for products from Lantronix, Westermo, Voltronic Power, Crestron, and APsystems, and one medical device security advisory for products from Orthanc.
Lantronix Advisory
This advisory describes a weak encoding for passwords vulnerability in the Lantronix XPort Device Server Configuration Manager. The vulnerability was reported by Aarón Flecha Menéndez of S21Sec. CISA reports that: “Lantronix states that XPort is an old legacy product and is not designed for strong encryption or TLS/SSL encryption. Users who require stronger encryption are encouraged to upgrade to xPort Edge.”
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to obtain credentials.
Westermo Advisory
This advisory describes eight vulnerabilities in the Westermo Lynx 206-F2G layer-three industrial Ethernet switch. The vulnerabilities were reported by Aarón Flecha Menéndez, Iván Alonso Álvarez and Víctor Bello Cuevas. Westermo provides generic mitigation measures.
The eight reported vulnerabilities are:
Cross-site scripting - CVE-2023-40143, CVE-2023-45222, CVE-2023-42765, CVE-2023-40544, and CVE-2023-45227,
Code injection - CVE-2023-45735,
Cross-origin resource sharing - CVE-2023-45213, and
Cross-site request forgery - CVE-2023-38579
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to access the web application, inject arbitrary code, execute malicious code, obtain sensitive information, or execute a malicious request.
Voltronic Advisory
This advisory describes four vulnerabilities in the Voltronic ViewPower Pro Uninterruptable Power Supply (UPS) management software. The vulnerability was reported by Simon Janz via the Zero Day Initiative. CISA notes that “Voltronic Power did not respond to CISA's attempts at coordination.”
The four reported vulnerabilities are:
Deserialization of untrusted data - CVE-2023-51570,
Missing authentication for critical function - CVE-2023-51571,
OS command injection - CVE-2023-51572,
Exposed dangerous method or function - CVE-2023-51573
Crestron Advisory
This advisory describes an OS command injection vulnerability in the Creston AM-300 AirMedia Presentation System. The vulnerability was reported by Uri Katz of Claroty Research Team82. Crestron has a new version that mitigates the vulnerability. There is no indication that Uri has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to escalate their privileges to root-level access.
APsystems Advisory
This advisory describes an improper access control vulnerability in the APsystems Energy Communication Unit (ECU-C) Power Control Software. The vulnerability was reported by Momen Eldawakhly (Cyber Guy) Samurai Digital Security, the report includes proof-of-concept code. CISA notes that: “APSystems has not responded to requests to work with CISA to mitigate this vulnerability.”
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to access sensitive data and execute specific commands and functions with full admin rights without authenticating.
Orthanc Advisory
This advisory describes a cross-site scripting vulnerability in the Orthanc Osimis Web Viewer. The vulnerability was reported by Noam Moshe of Claroty Team82. Orthanc has a new version that mitigates the vulnerability. There is no indication that Moshe has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to execute arbitrary JavaScript code inside the victim's browser.
NOTE: The Orthanc advisory reports that the product is deprecated, but they fixed it anyway, but recommended replacing with a newer product. They also noted that: “from this version, as a side effect of the security fix, the StudyDescription might not display correctly if it contains special characters and we will not fix that.”