1. EXECUTIVE SUMMARY

​CVSS v3 7.5
​ATTENTION: Exploitable remotely/low attack complexity
​Vendor: Hitachi Energy
​Equipment: RTU500 series
​Vulnerabilities: Stack-based Buffer Overflow

2. RISK EVALUATION

​Successful exploitation of these vulnerabilities could cause a buffer overflow and reboot of the product.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​Hitachi Energy reports these vulnerabilities affect the following RTU500 series products:

​RTU500 series CMU: Firmware versions 13.3.1–13.3.2

3.2 VULNERABILITY OVERVIEW

3.2.1 STACK-BASED BUFFER OVERFLOW CWE-121

​A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited if the HCI 60870-5-104 is configured with IEC 62351-5 support and the CMU contains the license feature ‘Advanced security’ which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation, which eventually, if exploited, could cause an internal buffer to overflow in the HCI IEC 60870-5-104 function.

​CVE-2022-2502 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.2 ​ STACK-BASED BUFFER OVERFLOW CWE-121

​A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited if the HCI 60870-5-104 is configured with support for IEC 62351-3. After session resumption interval is expired, an RTU500 initiated update of session parameters could cause an unexpected restart due to a stack overflow.

​CVE-2022-4608 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Energy
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Switzerland

3.4 RESEARCHER

​Hitachi Energy reported these vulnerabilities to CISA.

4. MITIGATIONS

​Hitachi Energy recommends users update to CMU Firmware versions 13.3.3 or 13.4.1.

​The reported vulnerabilities affect only the RTU500 series with HCI IEC 60870-5-104 and IEC62351-5 or IEC 62351-5 configured and enabled. A possible mitigation is to disable the HCI IEC 60870-5-104 function or its IEC 62351-3 and IEC 62351-5 features if they are not used. By default, the HCI IEC 60870-5-104 and its IEC 62351-3 or IEC 62351-5 support are disabled.

​Hitachi Energy recommends the following general mitigations:

​Recommended security practices and firewall configurations can help protect a process control network from attacks originating from outside the network.
​Physically protect process control systems from direct access by unauthorized personnel.
​Ensure process control systems have no direct connections to the internet and are separated from other networks via a firewall system with minimal exposed ports.
​Do not use process control systems for internet surfing, instant messaging, or receiving emails.
​Scan portable computers and removable storage media for malware prior connection to a control system.
​Enforce proper password policies and processes.

​For more information, see Hitachi Energy’s Security Advisory: 8DBD000121.

​CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target these vulnerabilities. These vulnerabilities are exploitable remotely. These vulnerabilities have low attack complexity.

1. EXECUTIVE SUMMARY

​CVSS v3 7.1
​ATTENTION: Low attack complexity
​Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc.
​Equipment: VideoEdge
​Vulnerability: Acceptance of Extraneous Untrusted Data with Trusted Data

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow a local user to edit the VideoEdge configuration file and interfere with VideoEdge operation.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following Sensormatic Electronics, a subsidiary of Johnson Controls Inc, products are affected: 

​VideoEdge: Versions prior to 6.1.1

3.2 VULNERABILITY OVERVIEW

3.2.1 ​ACCEPTANCE OF EXTRANEOUS UNTRUSTED DATA WITH TRUSTED DATA CWE-349

​In Sensormatic VideoEdge versions prior to 6.1.1, a local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.

​CVE-2023-3749 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Ireland

3.4 RESEARCHER

​Johnson Controls, Inc. reported this vulnerability to CISA.

4. MITIGATIONS

​Sensormatic Electronics recommends users take the following action to apply proper mitigations:

​Update VideoEdge to version 6.1.1. The update can be downloaded from http://www.americandynamics.net under Support/Software Downloads/Network Video Recorders.

​For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2023-07 v1 at the following location: https://www.johnsoncontrols.com/cyber-solutions/security-advisories

​Further ICS security notices and product security guidance are located at our product security website.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: TEL-STER Sp. z o. o.
Equipment: TelWin SCADA WebInterface
Vulnerability: Path Traversal

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an unauthenticated attacker to read files on the system.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

TEL-STER reports this vulnerability affects the following versions of TelWin SCADA WebInterface:

TelWin SCADA WebInterface: versions 3.2 to 6.1
TelWin SCADA WebInterface: versions 7.0 to 7.1
TelWin SCADA WebInterface: versions 8.0 and 9.0

3.2 VULNERABILITY OVERVIEW

3.2.1 PATH TRAVERSAL CWE-35

External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.

CVE-2023-0956 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Multiple sectors
COUNTRIES/AREAS DEPLOYED: Poland
COMPANY HEADQUARTERS LOCATION: Poland

3.4 RESEARCHER

Marcin Dudek of CERT.PL reported this vulnerability to TEL-STER.

4. MITIGATIONS

TEL-STER recommends that users update WebInterface module to one of the following versions: 6.2, 7.2, 8.1, 9.1, or 10.0. Please note that the WebInterface is part of the TelWin SCADA software and is usually updated with the software. TEL-STER only currently supports and updates TelWin SCADA 7.8 (WebInteraface 6.x) upwards TEL-STER does not have any updates planned for versions using older vulnerable WebInterface (lower than 6.0), and users are recommended to update TelWin SCADA to one of the supported versions. For more information, please contact TEL-STER.

More information about this issue and the associated mitigation can be found at TEL-STER advisory or CERT.PL advisory.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is exploitable remotely. This vulnerability has low attack complexity.

1. EXECUTIVE SUMMARY

​CVSS v3 5.9
​ATTENTION: Exploitable remotely
​Vendor: Mitsubishi Electric
​Equipment: GOT2000 Series and GOT SIMPLE Series
​Vulnerability: Predictable Exact Value from Previous Values

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to hijack data connections or prevent legitimate users from establishing data connections.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​Mitsubishi Electric reports this vulnerability affects the following HMIs when using the “FTP server” function:

​GOT2000 Series, GT21 model: versions 01.49.000 and prior
​GOT SIMPLE, GS21 model: versions 01.49.000 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 ​PREDICTABLE EXACT VALUE FROM PREVIOUS VALUES CWE-342

​A denial-of-service and spoofing (session hijacking of data connections) vulnerability exists in the FTP server function on GOT2000 series and GOT SIMPLE series because the port number of a data connection can be easily guessed due to predictable exact value from previous values.

​CVE-2023-3373 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

​Mitsubishi Electric reported this vulnerability to CISA.

4. MITIGATIONS

Mitsubishi Electric has created the following versions to fix this issue: 

​GOT2000 Series, GT21 model version 01.50.000 or later
​GOT SIMPLE, GS21 model version 01.50.000 or later

​Mitsubishi Electric recommends the following steps to update:

​Please contact your local Mitsubishi Electric representative to download the fixed version of GT Designer3 Version1 (GOT2000) and install on a personal computer. 
​Start the GT Designer3 Version1 (GOT2000) and open the project data used in affected products. 
​Select [Write to GOT] from [Communication] menu to write the required package data to the GOT. ​Please refer to the GT Designer3 Version1 (GOT2000) Screen Design Manual (SH-081220ENG). ​“4. COMMUNICATING WITH GOT” 
​After writing the required package data to the GOT, refer to the and check that the software has been updated to the fixed versions. 

​The fixed versions are shipped with GT Designer3 Version1(GOT2000) Ver. 1.300 N or later.

​Mitsubishi Electric recommends that customers take the following mitigations or workarounds to minimize the risk of exploiting this vulnerability:

​Restrict physical access to the product and the LAN to which it is connected.
​When Internet access is required, use a virtual private network (VPN) or other means to prevent unauthorized access.
​Use the products within a LAN and block access from untrusted networks and hosts.
​Install antivirus software on your computer that can access the affected product.
​Use the IP filter function to restrict the accessible IP addresses.
​GT Designer3 (GOT2000) Screen Design Manual (SH-081220ENG). “5.4.3 Setting the IP filter”

​Review whether the FTP server function is required or not, and if not, disable the FTP server function.

​Users should refer to Mitsubishi Electric’s security advisory for further information.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​CISA also recommends users take the following measures to protect themselves from social engineering attacks:

​Do not click web links or open attachments in unsolicited email messages.
​Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. 
​Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

​No known public exploits specifically target this vulnerability. This vulnerability is exploitable remotely. This vulnerability has high attack complexity.

1. EXECUTIVE SUMMARY

​CVSS v3 7.5
​ATTENTION: Exploitable remotely/low attack complexity
​Vendor: Mitsubishi Electric
​Equipment: GT Designer3, GOT2000 Series, GOT SIMPLE Series, and GT SoftGOT2000
​Vulnerability: Weak Encoding for Password

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following Mitsubishi Electric products are affected when either of the following cases apply: 

​The case of transferring data with GT Designer3 Version1(GOT2000) listed below and GOT2000 Series or GOT SIMPLE Series listed below with the Data Transfer Security function enabled. 
​The case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 listed below and GOT2000 series listed below with the Data Transfer Security function enabled. 
​GT Designer3 Version1 (GOT2000): v1.295H and prior
​GT SoftGOT2000: v1.295H and prior
​GOT2000 (Models GT21, GT23, GT25, GT27): v01.49.000 and prior
​GOT SIMPLE (Models GS25, GS21): v01.49.000 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 ​WEAK ENCODING FOR PASSWORD CWE-261 

​Information disclosure vulnerability exists in the Data Transfer Security function on GT Designer3, GOT2000 Series, GOT SIMPLE Series and GT SoftGOT2000. This vulnerability allows an attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords.

​CVE-2023-0525 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

​JINYOUNG KIM, JEONGHOON BAE, YIJOON JUNG, and HYEOKJONG YUN of “ot vulnerability” reported this vulnerability to Mitsubishi Electric.

4. MITIGATIONS

Mitsubishi Electric recommends updating to the following mitigated version to minimize the risk of exploiting this vulnerability:

​GT Designer3 Version1 (GOT2000): Update to v1.300N or later
​GT SoftGOT2000: Update to v1.300N or later
​GOT2000 (Models GT21, GT23, GT25, GT27): Update to v01.50.000 or later
​GOT SIMPLE (Models GS25, GS21): Update to v01.50.000 or later

​Mitsubishi Electric recommends taking applying the following mitigations to minimize the risk of exploiting this vulnerability:

​Encrypt communication paths to the affected product with a VPN or other means.
​When internet access is required, use a virtual private network (VPN) or other means to prevent unauthorized access.
​Use the affected products within a LAN and block access from untrusted networks and hosts.
​Prevent physical access to the network to which the product is connected.
​Install antivirus software on your personal computer that can access the affected product.
​Use the IP filter function to restrict the accessible IP addresses.
​For details on the IP filter function, please refer to GT Designer3 (GOT2000) Screen Design Manual (SH-081220ENG), “5.4.3 Setting the IP filter.”

​For update instructions and additional information, refer to Mitsubishi Electric’s security bulletin.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

​CVSS v3 9.8
​ATTENTION: Exploitable remotely / low attack complexity / public exploits available
​Vendor: APSystems
​Equipment: Altenergy Power Control
​Vulnerability: OS Command Injection

2. RISK EVALUATION

​Successful exploitation of this vulnerability may allow remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following versions of Altenergy Power Control software are affected: 

​Altenergy Power Control Software: C1.2.5

3.2 VULNERABILITY OVERVIEW

3.2.1 ​IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND (‘OS COMMAND INJECTION’) CWE-78

​OS command injection affects Altenergy Power Control software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.

​CVE-2023-28343 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated. The CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Energy
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

​CISA discovered public proof of concept as authored by Ahmed Alroky and superzerosec.

4. MITIGATIONS

​APSystems has not responded to requests to work with CISA to mitigate this vulnerability. Users of the affected product are encouraged to contact APSystems support for additional information.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​CISA also recommends users take the following measures to protect themselves from social engineering attacks:

​Do not click web links or open attachments in unsolicited email messages.
​Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
​Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

1. EXECUTIVE SUMMARY

CVSS v3 7.1
ATTENTION: Exploitable with adjacent access/low attack complexity
Vendor: ETIC Telecom
Equipment: Remote Access Server (RAS)
Vulnerability: Insecure Default Initialization of Resource

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to reconfigure the device or cause a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of ETIC Telecom RAS are affected: 

ETIC Telecom RAS: All versions 4.7.0 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 INSECURE DEFAULT INITIALIZATION OF RESOURCE CWE-1188 

ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.

CVE-2023-3453 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Multiple
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA.

4. MITIGATIONS

ETIC Telecom recommends updating the affected devices’ firmware to the following versions:

ETIC Telecom RAS: version 4.9.0 or later

ETIC Telecom recommends enabling the authentication mechanism on the administration interface. This can be done on the page “> Setup > Security > Administration right” by creating an administrator on the “List of administrators” table, enabling the parameter “Password protect the configuration interface,” then setting the parameter “Protocols to use for configuration” to “HTTPs only”.

NOTE: for firmware versions 4.9.0 or later, enabling the administration protection is mandatory after the first product start.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: PTC
Equipment: KEPServerEX
Vulnerability: Uncontrolled Resource Consumption

2. RISK EVALUATION

Successful exploitation of this vulnerability could result in the affected device crashing.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of KEPServerEX, an industrial automation data concentrator and device manager, are affected:

KEPServerEX: Versions 6.0 to 6.14.263

3.2 VULNERABILITY OVERVIEW

3.2.1 UNCONTROLLED RESOURCE CONSUMPTION CWE-400

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a check to see if such an object is recursively defined, so an attack could send a maliciously created message that the decoder would try to decode until the stack overflowed and the device crashed.

CVE-2023-3825 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Claroty Team82 reported this vulnerability to PTC and CISA.

4. MITIGATIONS

PTC wishes to inform users that the attack vector leveraged during the research involved an un-authenticated OPC UA Client. Standard controls available in the product and outlined in the Secure Deployment guide are sufficient to mitigate this vulnerability. Please refer to this article for additional details.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

CVSS v3 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Mitsubishi Electric
Equipment: CNC Series devices
Vulnerability: Classic Buffer Overflow

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow a malicious remote attacker to cause a denial-of-service condition and execute malicious code on the product by sending specially crafted packets. System reset is required for recovery.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Mitsubishi Electric CNC series products are affected:

M8V Series 
M800VW (BND-2051W000-**): All versions
M800VS (BND-2052W000-**): All versions
M80V (BND-2053W000-**): All versions
M80VW (BND-2054W000-**): All Versions

M8 Series 
M800W (BND-2005W000-**): All versions
M800S (BND-2006W000-**): All versions
M80 (BND-2007W000-**): All versions
M80W (BND-2008W000-**): All versions
E80 (BND-2009W000-**): All versions

C80
C80 C80 (BND-2036W000-**): All Versions
M7V Series
M700VW (BND-1012W000-**): All versions
M700VS (BND-1015W000-**): All versions
M70V (BND-1018W000-**): All versions
E70 (BND-1022W000-**): All versions

IoT Unit 
Remote Service Gateway Unit (BND-2041W001-**): All versions
Data Acquisition Unit BND-2041W002-**): All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT (‘CLASSIC BUFFER OVERFLOW’) CWE-120

In all versions of Mitsubishi Electric CNC series devices, a malicious remote attacker could cause a denial-of-service condition and execute malicious code by sending specially crafted packets.

CVE-2023-3346 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

01dGu0 of Zhejiang Qian Information & Technology Co., LTD reported this vulnerability to Mitsubishi Electric.

4. MITIGATIONS

To minimize the risk, Mitsubishi Electric recommends customers apply the following mitigations:

Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
Install anti-virus software on the PC that can access the product.
Use within a LAN and block access from untrusted networks and hosts through firewalls.
Restrict physical access to the affected product and the LAN to which the product is connected.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

CVSS v3 9.4
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Emerson
Equipment: ROC800-Series RTU; including ROC800, ROC800L, and DL8000 Preset Controllers
Vulnerability: Authentication Bypass

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition or gain unauthorized access to data or control of the device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following products are affected:

ROC809 & ROC827— All firmware versions, all hardware series
ROC809L & ROC827L— All firmware versions
DL8000— All firmware versions, all hardware series

The Series 1 ROC800 and DL8000 became obsolete in 2008 when the Series 2 was introduced.

3.2 VULNERABILITY OVERVIEW

3.2.1 Authentication Bypass By Primary Weakness CWE-305

ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.

CVE-2023-1935 has been assigned to this vulnerability. A CVSS v3 base score of 9.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).

3.3 BACKGROUND

Critical Infrastructure Sectors: Multiple Sectors
Countries/Areas Deployed: Worldwide
Company Headquarters Location: USA

3.4 RESEARCHER

Emerson reported this vulnerability to CISA.

4. MITIGATIONS

Emerson ROC800-Series RTU firmware updates can be applied to patch the authentication vulnerability:

ROC800 Series 2—3.91 firmware or later at SupportNet Portal (login required)
ROC800 Series 1—Update hardware to Series 2 with 3.91 firmware or later
ROC800L Series 2—1.71 firmware or later at SupportNet Portal (login required)
DL8000 Series 2—2.60 firmware or later at SupportNet Portal (login required)
DL8000 Series 1—Update hardware to Series 2 with 2.60 firmware or later

Before installing firmware into the RTU, validate the MD5/SHA256 Hashes published by Emerson on SupportNet match the firmware image confirming it is genuine and unmodified.

Emerson recommends users follow guidance in the ROC800-Series Remote Operations Controller Instruction Manual under section 1.11 Secure Gateway D301766X012.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.