1. EXECUTIVE SUMMARY

​CVSS v3 7.8
​ATTENTION: Low attack complexity
​Vendor: Siemens
​Equipment: Parasolid
​Vulnerability: Incorrect Permission Assignment for Critical Resource

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to misuse the vulnerability and escalate privileges.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following products from Siemens are affected if installed with Parasolid installer:

​Parasolid V35.0: All versions
​Parasolid V35.1: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 INCORRECT PERMISSION ASSIGNMENT FOR CRITICAL RESOURCE CWE-732

​Nullsoft Scriptable Install System (NSIS) before v3.09 creates an “uninstall directory” with insufficient access control. This could allow an attacker to misuse the vulnerability and escalate privileges.

​CVE-2023-37378 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Multiple Sectors
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

​Siemens reported this vulnerability to CISA.

4. MITIGATIONS

nly systems on which Parasolid is installed with a Parasolid installer is impacted. Siemens recommends uninstalling impacted Parasolid instances and reinstalling with the latest available installer:

​Parasolid v35.0: Latest installer.
​Parasolid v35.1: Latest installer.

​Siemens identified the following specific workarounds and mitigations users can apply to reduce risk:

​Scan each computer on which Parasolid has ever been installed with an up-to-date anti-virus program and follow its recommendations.
​Ensure only trusted persons have access to the system and avoid the configuration of additional accounts.

​As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following product manual recommendations.

​Additional information on Siemens industrial security can be found on the Siemens industrial security webpage.

​For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT.

​For more information see the associated Siemens security advisory SSA-116172 in HTML and CSAF.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.

1. EXECUTIVE SUMMARY

​CVSS v3 7.5
​ATTENTION: Exploitable remotely/low attack complexity
​Vendor: Hitachi Energy
​Equipment: RTU500 series
​Vulnerabilities: Stack-based Buffer Overflow

2. RISK EVALUATION

​Successful exploitation of these vulnerabilities could cause a buffer overflow and reboot of the product.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​Hitachi Energy reports these vulnerabilities affect the following RTU500 series products:

​RTU500 series CMU: Firmware versions 13.3.1–13.3.2

3.2 VULNERABILITY OVERVIEW

3.2.1 STACK-BASED BUFFER OVERFLOW CWE-121

​A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited if the HCI 60870-5-104 is configured with IEC 62351-5 support and the CMU contains the license feature ‘Advanced security’ which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation, which eventually, if exploited, could cause an internal buffer to overflow in the HCI IEC 60870-5-104 function.

​CVE-2022-2502 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.2 ​ STACK-BASED BUFFER OVERFLOW CWE-121

​A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited if the HCI 60870-5-104 is configured with support for IEC 62351-3. After session resumption interval is expired, an RTU500 initiated update of session parameters could cause an unexpected restart due to a stack overflow.

​CVE-2022-4608 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Energy
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Switzerland

3.4 RESEARCHER

​Hitachi Energy reported these vulnerabilities to CISA.

4. MITIGATIONS

​Hitachi Energy recommends users update to CMU Firmware versions 13.3.3 or 13.4.1.

​The reported vulnerabilities affect only the RTU500 series with HCI IEC 60870-5-104 and IEC62351-5 or IEC 62351-5 configured and enabled. A possible mitigation is to disable the HCI IEC 60870-5-104 function or its IEC 62351-3 and IEC 62351-5 features if they are not used. By default, the HCI IEC 60870-5-104 and its IEC 62351-3 or IEC 62351-5 support are disabled.

​Hitachi Energy recommends the following general mitigations:

​Recommended security practices and firewall configurations can help protect a process control network from attacks originating from outside the network.
​Physically protect process control systems from direct access by unauthorized personnel.
​Ensure process control systems have no direct connections to the internet and are separated from other networks via a firewall system with minimal exposed ports.
​Do not use process control systems for internet surfing, instant messaging, or receiving emails.
​Scan portable computers and removable storage media for malware prior connection to a control system.
​Enforce proper password policies and processes.

​For more information, see Hitachi Energy’s Security Advisory: 8DBD000121.

​CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target these vulnerabilities. These vulnerabilities are exploitable remotely. These vulnerabilities have low attack complexity.

1. EXECUTIVE SUMMARY

​CVSS v3 7.8
​ATTENTION: low attack complexity
​Vendor: Schneider Electric
​Equipment: IGSS (Interactive Graphical SCADA System)
​Vulnerability: Deserialization of Untrusted Data

2. RISK EVALUATION

​Successful exploitation of this vulnerability may allow arbitrary code execution or loss of control of the SCADA system.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​Schneider Electric reports this vulnerability affects the following IGSS (Interactive Graphical SCADA System) products:  

​IGSS Dashboard (DashBoard.exe): v16.0.0.23130 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 DESERIALIZATION OF UNTRUSTED DATA CWE-502

​A deserialization of untrusted data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to arbitrary code execution when an attacker gets the user to open a malicious file.

​CVE-2023-3001 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

​Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative reported this vulnerability to Schneider Electric and CISA.

4. MITIGATIONS

​Schneider Electric has provided version 16.0.0.23131 of Dashboard to address these vulnerabilities. The update is available for download through IGSS Master > Update IGSS Software or from the Schneider Electric support page.

​If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

​Review and implement the security guideline for IGSS on securing an IGSS SCADA installation.
​Follow the general security recommendation below and verify that devices are isolated on a private network and that firewalls are configured with strict boundaries for devices that require remote access.

​For more information, see the Schneider Electric security notification SEVD-2023-164-02.

​Schneider Electric recommends the following industry cybersecurity best practices.

​Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
​Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
​Place all controllers in locked cabinets and never leave them in the “Program” mode.
​Never connect programming software to any network other than the network intended for that device.
​Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
​Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
​Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the internet.
​When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​CISA also recommends users take the following measures to protect themselves from social engineering attacks:

​Do not click web links or open attachments in unsolicited email messages.
​Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
​Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

​No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely. This vulnerability has low attack complexity.

1. EXECUTIVE SUMMARY

​CVSS v3 7.1
​ATTENTION: Low attack complexity
​Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc.
​Equipment: VideoEdge
​Vulnerability: Acceptance of Extraneous Untrusted Data with Trusted Data

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow a local user to edit the VideoEdge configuration file and interfere with VideoEdge operation.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following Sensormatic Electronics, a subsidiary of Johnson Controls Inc, products are affected: 

​VideoEdge: Versions prior to 6.1.1

3.2 VULNERABILITY OVERVIEW

3.2.1 ​ACCEPTANCE OF EXTRANEOUS UNTRUSTED DATA WITH TRUSTED DATA CWE-349

​In Sensormatic VideoEdge versions prior to 6.1.1, a local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.

​CVE-2023-3749 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Ireland

3.4 RESEARCHER

​Johnson Controls, Inc. reported this vulnerability to CISA.

4. MITIGATIONS

​Sensormatic Electronics recommends users take the following action to apply proper mitigations:

​Update VideoEdge to version 6.1.1. The update can be downloaded from http://www.americandynamics.net under Support/Software Downloads/Network Video Recorders.

​For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2023-07 v1 at the following location: https://www.johnsoncontrols.com/cyber-solutions/security-advisories

​Further ICS security notices and product security guidance are located at our product security website.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.

1. EXECUTIVE SUMMARY

​CVSS v3 5.9
​ATTENTION: Exploitable remotely
​Vendor: Mitsubishi Electric
​Equipment: GOT2000 Series and GOT SIMPLE Series
​Vulnerability: Predictable Exact Value from Previous Values

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to hijack data connections or prevent legitimate users from establishing data connections.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​Mitsubishi Electric reports this vulnerability affects the following HMIs when using the “FTP server” function:

​GOT2000 Series, GT21 model: versions 01.49.000 and prior
​GOT SIMPLE, GS21 model: versions 01.49.000 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 ​PREDICTABLE EXACT VALUE FROM PREVIOUS VALUES CWE-342

​A denial-of-service and spoofing (session hijacking of data connections) vulnerability exists in the FTP server function on GOT2000 series and GOT SIMPLE series because the port number of a data connection can be easily guessed due to predictable exact value from previous values.

​CVE-2023-3373 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

​Mitsubishi Electric reported this vulnerability to CISA.

4. MITIGATIONS

Mitsubishi Electric has created the following versions to fix this issue: 

​GOT2000 Series, GT21 model version 01.50.000 or later
​GOT SIMPLE, GS21 model version 01.50.000 or later

​Mitsubishi Electric recommends the following steps to update:

​Please contact your local Mitsubishi Electric representative to download the fixed version of GT Designer3 Version1 (GOT2000) and install on a personal computer. 
​Start the GT Designer3 Version1 (GOT2000) and open the project data used in affected products. 
​Select [Write to GOT] from [Communication] menu to write the required package data to the GOT. ​Please refer to the GT Designer3 Version1 (GOT2000) Screen Design Manual (SH-081220ENG). ​“4. COMMUNICATING WITH GOT” 
​After writing the required package data to the GOT, refer to the and check that the software has been updated to the fixed versions. 

​The fixed versions are shipped with GT Designer3 Version1(GOT2000) Ver. 1.300 N or later.

​Mitsubishi Electric recommends that customers take the following mitigations or workarounds to minimize the risk of exploiting this vulnerability:

​Restrict physical access to the product and the LAN to which it is connected.
​When Internet access is required, use a virtual private network (VPN) or other means to prevent unauthorized access.
​Use the products within a LAN and block access from untrusted networks and hosts.
​Install antivirus software on your computer that can access the affected product.
​Use the IP filter function to restrict the accessible IP addresses.
​GT Designer3 (GOT2000) Screen Design Manual (SH-081220ENG). “5.4.3 Setting the IP filter”

​Review whether the FTP server function is required or not, and if not, disable the FTP server function.

​Users should refer to Mitsubishi Electric’s security advisory for further information.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​CISA also recommends users take the following measures to protect themselves from social engineering attacks:

​Do not click web links or open attachments in unsolicited email messages.
​Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. 
​Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

​No known public exploits specifically target this vulnerability. This vulnerability is exploitable remotely. This vulnerability has high attack complexity.

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: TEL-STER Sp. z o. o.
Equipment: TelWin SCADA WebInterface
Vulnerability: Path Traversal

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an unauthenticated attacker to read files on the system.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

TEL-STER reports this vulnerability affects the following versions of TelWin SCADA WebInterface:

TelWin SCADA WebInterface: versions 3.2 to 6.1
TelWin SCADA WebInterface: versions 7.0 to 7.1
TelWin SCADA WebInterface: versions 8.0 and 9.0

3.2 VULNERABILITY OVERVIEW

3.2.1 PATH TRAVERSAL CWE-35

External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.

CVE-2023-0956 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Multiple sectors
COUNTRIES/AREAS DEPLOYED: Poland
COMPANY HEADQUARTERS LOCATION: Poland

3.4 RESEARCHER

Marcin Dudek of CERT.PL reported this vulnerability to TEL-STER.

4. MITIGATIONS

TEL-STER recommends that users update WebInterface module to one of the following versions: 6.2, 7.2, 8.1, 9.1, or 10.0. Please note that the WebInterface is part of the TelWin SCADA software and is usually updated with the software. TEL-STER only currently supports and updates TelWin SCADA 7.8 (WebInteraface 6.x) upwards TEL-STER does not have any updates planned for versions using older vulnerable WebInterface (lower than 6.0), and users are recommended to update TelWin SCADA to one of the supported versions. For more information, please contact TEL-STER.

More information about this issue and the associated mitigation can be found at TEL-STER advisory or CERT.PL advisory.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is exploitable remotely. This vulnerability has low attack complexity.

1. EXECUTIVE SUMMARY

​CVSS v3 7.5
​ATTENTION: Exploitable remotely/low attack complexity
​Vendor: Mitsubishi Electric
​Equipment: GT Designer3, GOT2000 Series, GOT SIMPLE Series, and GT SoftGOT2000
​Vulnerability: Weak Encoding for Password

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following Mitsubishi Electric products are affected when either of the following cases apply: 

​The case of transferring data with GT Designer3 Version1(GOT2000) listed below and GOT2000 Series or GOT SIMPLE Series listed below with the Data Transfer Security function enabled. 
​The case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 listed below and GOT2000 series listed below with the Data Transfer Security function enabled. 
​GT Designer3 Version1 (GOT2000): v1.295H and prior
​GT SoftGOT2000: v1.295H and prior
​GOT2000 (Models GT21, GT23, GT25, GT27): v01.49.000 and prior
​GOT SIMPLE (Models GS25, GS21): v01.49.000 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 ​WEAK ENCODING FOR PASSWORD CWE-261 

​Information disclosure vulnerability exists in the Data Transfer Security function on GT Designer3, GOT2000 Series, GOT SIMPLE Series and GT SoftGOT2000. This vulnerability allows an attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords.

​CVE-2023-0525 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

​JINYOUNG KIM, JEONGHOON BAE, YIJOON JUNG, and HYEOKJONG YUN of “ot vulnerability” reported this vulnerability to Mitsubishi Electric.

4. MITIGATIONS

Mitsubishi Electric recommends updating to the following mitigated version to minimize the risk of exploiting this vulnerability:

​GT Designer3 Version1 (GOT2000): Update to v1.300N or later
​GT SoftGOT2000: Update to v1.300N or later
​GOT2000 (Models GT21, GT23, GT25, GT27): Update to v01.50.000 or later
​GOT SIMPLE (Models GS25, GS21): Update to v01.50.000 or later

​Mitsubishi Electric recommends taking applying the following mitigations to minimize the risk of exploiting this vulnerability:

​Encrypt communication paths to the affected product with a VPN or other means.
​When internet access is required, use a virtual private network (VPN) or other means to prevent unauthorized access.
​Use the affected products within a LAN and block access from untrusted networks and hosts.
​Prevent physical access to the network to which the product is connected.
​Install antivirus software on your personal computer that can access the affected product.
​Use the IP filter function to restrict the accessible IP addresses.
​For details on the IP filter function, please refer to GT Designer3 (GOT2000) Screen Design Manual (SH-081220ENG), “5.4.3 Setting the IP filter.”

​For update instructions and additional information, refer to Mitsubishi Electric’s security bulletin.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

​CVSS v3 9.8
​ATTENTION: Exploitable remotely / low attack complexity / public exploits available
​Vendor: APSystems
​Equipment: Altenergy Power Control
​Vulnerability: OS Command Injection

2. RISK EVALUATION

​Successful exploitation of this vulnerability may allow remote code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following versions of Altenergy Power Control software are affected: 

​Altenergy Power Control Software: C1.2.5

3.2 VULNERABILITY OVERVIEW

3.2.1 ​IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND (‘OS COMMAND INJECTION’) CWE-78

​OS command injection affects Altenergy Power Control software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.

​CVE-2023-28343 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated. The CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Energy
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

​CISA discovered public proof of concept as authored by Ahmed Alroky and superzerosec.

4. MITIGATIONS

​APSystems has not responded to requests to work with CISA to mitigate this vulnerability. Users of the affected product are encouraged to contact APSystems support for additional information.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​CISA also recommends users take the following measures to protect themselves from social engineering attacks:

​Do not click web links or open attachments in unsolicited email messages.
​Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
​Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: PTC
Equipment: KEPServerEX
Vulnerability: Uncontrolled Resource Consumption

2. RISK EVALUATION

Successful exploitation of this vulnerability could result in the affected device crashing.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of KEPServerEX, an industrial automation data concentrator and device manager, are affected:

KEPServerEX: Versions 6.0 to 6.14.263

3.2 VULNERABILITY OVERVIEW

3.2.1 UNCONTROLLED RESOURCE CONSUMPTION CWE-400

PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a check to see if such an object is recursively defined, so an attack could send a maliciously created message that the decoder would try to decode until the stack overflowed and the device crashed.

CVE-2023-3825 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Claroty Team82 reported this vulnerability to PTC and CISA.

4. MITIGATIONS

PTC wishes to inform users that the attack vector leveraged during the research involved an un-authenticated OPC UA Client. Standard controls available in the product and outlined in the Secure Deployment guide are sufficient to mitigate this vulnerability. Please refer to this article for additional details.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

1. EXECUTIVE SUMMARY

CVSS v3 7.1
ATTENTION: Exploitable with adjacent access/low attack complexity
Vendor: ETIC Telecom
Equipment: Remote Access Server (RAS)
Vulnerability: Insecure Default Initialization of Resource

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to reconfigure the device or cause a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of ETIC Telecom RAS are affected: 

ETIC Telecom RAS: All versions 4.7.0 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 INSECURE DEFAULT INITIALIZATION OF RESOURCE CWE-1188 

ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.

CVE-2023-3453 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Multiple
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA.

4. MITIGATIONS

ETIC Telecom recommends updating the affected devices’ firmware to the following versions:

ETIC Telecom RAS: version 4.9.0 or later

ETIC Telecom recommends enabling the authentication mechanism on the administration interface. This can be done on the page “> Setup > Security > Administration right” by creating an administrator on the “List of administrators” table, enabling the parameter “Password protect the configuration interface,” then setting the parameter “Protocols to use for configuration” to “HTTPs only”.

NOTE: for firmware versions 4.9.0 or later, enabling the administration protection is mandatory after the first product start.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.