Today CISA’s NCCIC-ICS published six control system security advisories for products from HMS, Schneider (3), Hitachi Energy, and mySCADA. I also take a down-the-rabbit-hole look at the coordination between the researcher and the vendor for one of the advisories.
HMS Advisory
This advisory describes a cleartext transmission of sensitive information vulnerability in the HMS EWON Flexy 202 IIoT data gateway. The vulnerability was reported by Khalid Markar, Parul Sindhwad and Dr. Faruk Kazi from CoE-CNDS Lab, VJTI. HMS provides generic mitigation measures.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to disclose sensitive user credentials.
Schneider Advisory #1
This advisory describes an improper restriction of operations within the bounds of a memory buffer vulnerability in the Schneider EcoStruxure Power Build Rapsody. The vulnerability was reported by Michael Heinzl (see DTRH discussion below).
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow local attackers to potentially execute arbitrary code when opening a malicious project file.
NOTE: I briefly discussed this vulnerability on Sunday.
Schneider Advisory #2
This advisory describes an improper privilege-management vulnerability in the Schneider Easergy Studio products. The vulnerability was reported by Charit Misra of Applied Risk. Schneider has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access to exploit the vulnerability to risk unauthorized access to the installation directory for Easergy Studio, which could allow an attacker with access to the file system to elevate privileges.
NOTE: I briefly discussed this vulnerability on October 12th, 2024.
Schneider Advisory #3
This advisory describes a cleartext storage of sensitive information vulnerability in the Schneider EVlink Home Smart and Schneider Charge charging stations. The vulnerability was reported by Simon Petitjean. Schneider has new versions that mitigate the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to may expose test credentials in the firmware binary.
NOTE: I briefly discussed this vulnerability on October 12th, 2024.
Hitachi Energy Advisory
This advisory describes an improperly implemented security check for standard vulnerability in the Hitachi Energy RTU500 series products. The vulnerability was self-reported. Hitachi Energy has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to update the RTU500 with unsigned firmware.
NOTE: I briefly discussed the vulnerability on May 4th, 2024.
MySCADA Advisory
This advisory describes two OS command injection vulnerabilities in the mySCADA myPRO products. The vulnerability was reported by Mehmet INCE from PRODAFT.com via the Zero Day Initiative.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow a remote attacker to execute arbitrary commands or disclose sensitive information.
DTRH – Researcher Vulnerability Reporting
As I briefly noted Sunday, Heinzl had reported five separate memory buffer vulnerabilities to Schneider. Those vulnerabilities were:
Heap-based buffer overflow (2) - AWE-2025-006 and AWE-2025-005,
Stack-based buffer overflow - AWE-2025-004, and
File parsing memory corruption (2) - AWE-2025-003 and AWE-2025-002
Each of the AWESEC advisories noted above contain identical disclosure timelines, describing the back and forth between Heinzl and Schneider. Interestingly, the initial report by Heinzl was to CISA in November 2023. There was a lot of back and forth between Heinzl and Schneider. The last three entries (before the publication of the Schneider advisory) in the timeline were instructive:
28.02.2024: Vendor states that the issues will be fixed, but due to the low CVSS score, no CVE will be assigned.
05.03.2024: Vendor states they did an internal reevaluation, and revised the CVSS score, and are going to assign one CVE.
26.09.2024: Vendor states that all five reported vulnerabilities have the same root cause, and therefore only assign one CVE.
Perhaps researchers discovering memory buffer related vulnerabilities should take a closer look to determine if other vulnerabilities could be developed that are similarly based upon the same root cause. I am still not sure if they should be treated as separate vulnerabilities or a single vulnerability based upon the root cause. I guess that it would depend on if it was possible to construct a fix that did not cover all of the dependent vulnerabilities.