1. EXECUTIVE SUMMARY

​CVSS v3 7.5
​ATTENTION: Exploitable remotely/low attack complexity
​Vendor: Mitsubishi Electric
​Equipment: GT Designer3, GOT2000 Series, GOT SIMPLE Series, and GT SoftGOT2000
​Vulnerability: Weak Encoding for Password

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following Mitsubishi Electric products are affected when either of the following cases apply: 

​The case of transferring data with GT Designer3 Version1(GOT2000) listed below and GOT2000 Series or GOT SIMPLE Series listed below with the Data Transfer Security function enabled. 
​The case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 listed below and GOT2000 series listed below with the Data Transfer Security function enabled. 
​GT Designer3 Version1 (GOT2000): v1.295H and prior
​GT SoftGOT2000: v1.295H and prior
​GOT2000 (Models GT21, GT23, GT25, GT27): v01.49.000 and prior
​GOT SIMPLE (Models GS25, GS21): v01.49.000 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 ​WEAK ENCODING FOR PASSWORD CWE-261 

​Information disclosure vulnerability exists in the Data Transfer Security function on GT Designer3, GOT2000 Series, GOT SIMPLE Series and GT SoftGOT2000. This vulnerability allows an attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords.

​CVE-2023-0525 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

​JINYOUNG KIM, JEONGHOON BAE, YIJOON JUNG, and HYEOKJONG YUN of “ot vulnerability” reported this vulnerability to Mitsubishi Electric.

4. MITIGATIONS

Mitsubishi Electric recommends updating to the following mitigated version to minimize the risk of exploiting this vulnerability:

​GT Designer3 Version1 (GOT2000): Update to v1.300N or later
​GT SoftGOT2000: Update to v1.300N or later
​GOT2000 (Models GT21, GT23, GT25, GT27): Update to v01.50.000 or later
​GOT SIMPLE (Models GS25, GS21): Update to v01.50.000 or later

​Mitsubishi Electric recommends taking applying the following mitigations to minimize the risk of exploiting this vulnerability:

​Encrypt communication paths to the affected product with a VPN or other means.
​When internet access is required, use a virtual private network (VPN) or other means to prevent unauthorized access.
​Use the affected products within a LAN and block access from untrusted networks and hosts.
​Prevent physical access to the network to which the product is connected.
​Install antivirus software on your personal computer that can access the affected product.
​Use the IP filter function to restrict the accessible IP addresses.
​For details on the IP filter function, please refer to GT Designer3 (GOT2000) Screen Design Manual (SH-081220ENG), “5.4.3 Setting the IP filter.”

​For update instructions and additional information, refer to Mitsubishi Electric’s security bulletin.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

​CVSS v3 9.8
​ATTENTION: Exploitable remotely / low attack complexity / public exploits available
​Vendor: APSystems
​Equipment: Altenergy Power Control
​Vulnerability: OS Command Injection

2. RISK EVALUATION

​Successful exploitation of this vulnerability may allow remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following versions of Altenergy Power Control software are affected: 

​Altenergy Power Control Software: C1.2.5

3.2 VULNERABILITY OVERVIEW

3.2.1 ​IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND (‘OS COMMAND INJECTION’) CWE-78

​OS command injection affects Altenergy Power Control software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.

​CVE-2023-28343 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated. The CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Energy
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

​CISA discovered public proof of concept as authored by Ahmed Alroky and superzerosec.

4. MITIGATIONS

​APSystems has not responded to requests to work with CISA to mitigate this vulnerability. Users of the affected product are encouraged to contact APSystems support for additional information.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​CISA also recommends users take the following measures to protect themselves from social engineering attacks:

​Do not click web links or open attachments in unsolicited email messages.
​Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
​Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

1. EXECUTIVE SUMMARY

CVSS v3 7.1
ATTENTION: Exploitable with adjacent access/low attack complexity
Vendor: ETIC Telecom
Equipment: Remote Access Server (RAS)
Vulnerability: Insecure Default Initialization of Resource

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to reconfigure the device or cause a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of ETIC Telecom RAS are affected: 

ETIC Telecom RAS: All versions 4.7.0 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 INSECURE DEFAULT INITIALIZATION OF RESOURCE CWE-1188 

ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.

CVE-2023-3453 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Multiple
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA.

4. MITIGATIONS

ETIC Telecom recommends updating the affected devices’ firmware to the following versions:

ETIC Telecom RAS: version 4.9.0 or later

ETIC Telecom recommends enabling the authentication mechanism on the administration interface. This can be done on the page “> Setup > Security > Administration right” by creating an administrator on the “List of administrators” table, enabling the parameter “Password protect the configuration interface,” then setting the parameter “Protocols to use for configuration” to “HTTPs only”.

NOTE: for firmware versions 4.9.0 or later, enabling the administration protection is mandatory after the first product start.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: PTC
Equipment: KEPServerEX
Vulnerability: Uncontrolled Resource Consumption

2. RISK EVALUATION

Successful exploitation of this vulnerability could result in the affected device crashing.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of KEPServerEX, an industrial automation data concentrator and device manager, are affected:

KEPServerEX: Versions 6.0 to 6.14.263

3.2 VULNERABILITY OVERVIEW

3.2.1 UNCONTROLLED RESOURCE CONSUMPTION CWE-400

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a check to see if such an object is recursively defined, so an attack could send a maliciously created message that the decoder would try to decode until the stack overflowed and the device crashed.

CVE-2023-3825 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Claroty Team82 reported this vulnerability to PTC and CISA.

4. MITIGATIONS

PTC wishes to inform users that the attack vector leveraged during the research involved an un-authenticated OPC UA Client. Standard controls available in the product and outlined in the Secure Deployment guide are sufficient to mitigate this vulnerability. Please refer to this article for additional details.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

CVSS v3 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Mitsubishi Electric
Equipment: CNC Series devices
Vulnerability: Classic Buffer Overflow

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow a malicious remote attacker to cause a denial-of-service condition and execute malicious code on the product by sending specially crafted packets. System reset is required for recovery.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Mitsubishi Electric CNC series products are affected:

M8V Series 
M800VW (BND-2051W000-**): All versions
M800VS (BND-2052W000-**): All versions
M80V (BND-2053W000-**): All versions
M80VW (BND-2054W000-**): All Versions

M8 Series 
M800W (BND-2005W000-**): All versions
M800S (BND-2006W000-**): All versions
M80 (BND-2007W000-**): All versions
M80W (BND-2008W000-**): All versions
E80 (BND-2009W000-**): All versions

C80
C80 C80 (BND-2036W000-**): All Versions
M7V Series
M700VW (BND-1012W000-**): All versions
M700VS (BND-1015W000-**): All versions
M70V (BND-1018W000-**): All versions
E70 (BND-1022W000-**): All versions

IoT Unit 
Remote Service Gateway Unit (BND-2041W001-**): All versions
Data Acquisition Unit BND-2041W002-**): All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT (‘CLASSIC BUFFER OVERFLOW’) CWE-120

In all versions of Mitsubishi Electric CNC series devices, a malicious remote attacker could cause a denial-of-service condition and execute malicious code by sending specially crafted packets.

CVE-2023-3346 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

01dGu0 of Zhejiang Qian Information & Technology Co., LTD reported this vulnerability to Mitsubishi Electric.

4. MITIGATIONS

To minimize the risk, Mitsubishi Electric recommends customers apply the following mitigations:

Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
Install anti-virus software on the PC that can access the product.
Use within a LAN and block access from untrusted networks and hosts through firewalls.
Restrict physical access to the affected product and the LAN to which the product is connected.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

CVSS v3 9.4
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Emerson
Equipment: ROC800-Series RTU; including ROC800, ROC800L, and DL8000 Preset Controllers
Vulnerability: Authentication Bypass

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition or gain unauthorized access to data or control of the device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following products are affected:

ROC809 & ROC827— All firmware versions, all hardware series
ROC809L & ROC827L— All firmware versions
DL8000— All firmware versions, all hardware series

The Series 1 ROC800 and DL8000 became obsolete in 2008 when the Series 2 was introduced.

3.2 VULNERABILITY OVERVIEW

3.2.1 Authentication Bypass By Primary Weakness CWE-305

ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.

CVE-2023-1935 has been assigned to this vulnerability. A CVSS v3 base score of 9.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).

3.3 BACKGROUND

Critical Infrastructure Sectors: Multiple Sectors
Countries/Areas Deployed: Worldwide
Company Headquarters Location: USA

3.4 RESEARCHER

Emerson reported this vulnerability to CISA.

4. MITIGATIONS

Emerson ROC800-Series RTU firmware updates can be applied to patch the authentication vulnerability:

ROC800 Series 2—3.91 firmware or later at SupportNet Portal (login required)
ROC800 Series 1—Update hardware to Series 2 with 3.91 firmware or later
ROC800L Series 2—1.71 firmware or later at SupportNet Portal (login required)
DL8000 Series 2—2.60 firmware or later at SupportNet Portal (login required)
DL8000 Series 1—Update hardware to Series 2 with 2.60 firmware or later

Before installing firmware into the RTU, validate the MD5/SHA256 Hashes published by Emerson on SupportNet match the firmware image confirming it is genuine and unmodified.

Emerson recommends users follow guidance in the ROC800-Series Remote Operations Controller Instruction Manual under section 1.11 Secure Gateway D301766X012.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

CVSS v3 8.3
ATTENTION: Low attack complexity
Vendor: Johnson Controls Inc.
Equipment: IQ Wifi 6
Vulnerability: Improper Restriction of Excessive Authentication Attempts

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an unauthorized user to gain account access by conducting a brute force authentication attack.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Johnson Controls products are affected:

IQ Wifi 6: All firmware versions prior to 2.0.2

3.2 VULNERABILITY OVERVIEW

3.2.1 Improper Restriction of Execssive Authentication Attempts CWE-307

In firmware versions prior to v2.0.2 of Johnson Controls IQ Wifi 6, an unauthorized user could gain account access by conducting a brute force authentication attack.

CVE-2023-3548 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).

3.3 BACKGROUND

Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Ireland

3.4 RESEARCHER

Johnson Controls, Inc. reported this vulnerability to CISA.

4. MITIGATIONS

Johnson Controls recommends apply the following mitigations to reduce the risk:

Upgrade IQ Wifi 6 firmware to version 2.0.2. (Contact Johnson Controls for assistance)
The firmware update will be pushed to all available devices in the field.
The firmware update can also be manually loaded by applying the patch tag “iqwifi2.0.2” on the device after navigating to its firmware update page.

For additional information, see Johnson Controls Product Security Advisory JCI-PSA-2023-06 v1.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Secure physical access.
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Rockwell Automation
Equipment: ThinManager ThinServer
Vulnerability: Relative Path Traversal

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow a remote actor to leverage the privileges of the server’s file system and read arbitrary files stored in it.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Rockwell Automation reports this vulnerability affects the following versions of ThinManager ThinServer, a thin client and remote desktop protocol (RDP) server management software:

ThinManager ThinServer: versions 13.0.0—13.0.2 and 13.1.0

3.2 VULNERABILITY OVERVIEW

3.2.1 Relative Path Traversal CWE-23

An executable used in the affected products can be configured to enable an API feature in the HTTPS server settings. This feature is disabled by default. When the API is enabled and handling requests, a path traversal vulnerability exists that could allow a remote actor to leverage the server’s file system privileges and read arbitrary files stored in it. A malicious user could exploit this vulnerability by executing a path that contains manipulating variables.

CVE-2023-2913 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.3 BACKGROUND

Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States

3.4 RESEARCHER

Rockwell Automation reported this vulnerability to CISA.

4. MITIGATIONS

Rockwell Automation encourages users of the affected software to apply risk mitigations, if possible, and encourages customers to implement their suggested security best practices to minimize the potential risk of vulnerability:

Update to the corrected software versions: 13.0.3 and 13.1.1 or later.
Disable the API feature and use a service account with appropriate access for the application.

For more information, users should see Rockwell Automation’s security advisory (login required).

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is exploitable remotely. This vulnerability has low attack complexity.

1. EXECUTIVE SUMMARY

CVSS v3 7.1
ATTENTION: Exploitable from adjacent network
Vendor: Axis Communications
Equipment: AXIS A1001
Vulnerability: Heap-based Buffer Overflow

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of AXIS A1001, a network door controller, are affected:

AXIS A1001: 1.65.4 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 HEAP-BASED BUFFER OVERFLOW CWE-122

A heap-based buffer overflow vulnerability exists in the AXIS 1001 versions 1.65.4 and prior. When communicating over the Open Supervised Device Protocol (OSDP), the pacsiod process that handles the OSDP communication allows for writing outside of the allocated buffer. By appending invalid data to an OSDP message, it is possible to write data beyond the heap allocated buffer. The data written outside the buffer could allow an attacker to execute arbitrary code.

CVE-2023-21406 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H).

3.3 BACKGROUND

Critical Infrastructure Sectors: Commercial Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Sweden

3.4 RESEARCHER

Ariel Harush and Roy Hodir of OTORIO reported this vulnerability to AXIS Communications.

4. MITIGATIONS

Axis has released a patched version for affected devices that fixes the vulnerability.

Axis recommends users to update the device software. The latest Axis device software can be found here.

For further assistance and questions, please contact AXIS Technical Support.

For more information on this vulnerability, please visit the Axis vulnerability management portal.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Schneider Electric
Equipment: EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers
Vulnerabilities: Improper Check for Unusual or Exceptional Conditions

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker unauthorized access to components, ability to execute arbitrary code, or ability to execute a denial-of-service.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

EcoStruxure Control Expert: All versions prior to V15.3
EcoStruxure Process Expert: Version V2020 and prior
Modicon M340 CPU (part numbers BMXP34*): All versions prior to SV3.51
Modicon M580 CPU (part numbers BMEP* and BMEH*): All versions prior to SV4.10
Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S): All versions
Modicon Momentum Unity M1E Processor (171CBU*): All versions prior to SV2.6
Modicon MC80 (BMKC80): All versions
Legacy Modicon Quantum (140CPU65*) and Premium CPUs (TSXP57*): All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER CHECK FOR UNUSUAL OR EXCEPTIONAL CONDITIONS CWE-754 

The affected components contain a vulnerability that could cause arbitrary code execution, a denial-of-service condition, and/or loss of confidentiality and integrity when an actor loads a malicious project file onto the controller.

CVE-2022-45788 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Jos Wetzels and Daniel dos Santos of Forescout Technologies reported these vulnerabilities to Schneider Electric.

4. MITIGATIONS

Schneider Electric released the following remediations for users to implement: 

EcoStruxure Process Expert: Version V2021 available for download and is not impacted by this vulnerability, as the affected component has been removed from this version.
EcoStruxure Control Expert: Software V15.3 includes a fix for this vulnerability and is available for download.
Modicon M580 (part numbers BMEP* and BMEH*, excluding M580 CPU Safety): Firmware SV4.10 includes a fix for this vulnerability and is available for download.
Modicon Momentum Unity M1E Processor (part numbers 171CBU*): Firmware VS2.6 includes a fix for this vulnerability and is available for download.
Modicon M340 CPU (part numbers BMXP34*): Firmware SV3.51 includes a fix for this vulnerability and is available for download.
Modicon MC80 CPU (part numbers BMKC80*): Firmware SV1.90 includes a fix for this vulnerability and is available for download.

Users should use appropriate patching methodologies when applying these patches to their systems. Schneider Electric recommends using backups and evaluating the impact of these patches in a “testing and development environment” or on an offline infrastructure.

Users should contact Schneider Electric for assistance in removing a patch.

Users should apply the best practices for network hardening as documented in the product user guide and the Schneider Electric Recommended Cybersecurity Best Practices.

For more information, see Schneider Electric’s security advisory SEVD-2023-010-05.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages. 
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploits specifically target these vulnerabilities.