The US Cybersecurity and Infrastructure Security Agency (CISA) has published four Industrial Control Systems (ICS) advisories, calling out several security flaws affecting products from Siemens, GE Digital, and Contec. The most critical of the issues have been identified in Siemens SINEC INS that could lead to remote code execution via a path traversal flaw (CVE-2022-45092, CVSS score: 9.9) and command injection (CVE-2022-2068, CVSS score: 9.8). Also patched by Siemens is an authentication bypass vulnerability in llhttp parser (CVE-2022-35256, CVSS score: 9.8) as well as an out-of-bounds write bug in the OpenSSL library (CVE-2022-2274, CVSS score: 9.8) that could be exploited to trigger remote code execution.
The German automation company in December 2022, released Service Pack 2 Update 1 software to mitigate the flaws. Separately, a critical flaw has also been revealed in GE Digital's Proficy Historian solution that could result in code execution regardless of authentication status. The issue, tracked as CVE-2022-46732 (CVSS score: 9.8), impacts Proficy Historian versions 7.0 and higher, and has been remediated in Proficy Historian 2023.
An attacker can take advantage of this fact and bypass the historian authentication by impersonating a local service. This allows remote attackers the ability to log in to any GE Proficy Historian server and force it to perform unauthorized actions."
CISA also updated an ICS advisory that was published in December 2022, detailing a critical command injection vulnerability in Contec CONPROSYS HMI System (CVE-2022-44456, CVSS score: 10.0) that could permit a remote attacker to send specially crafted requests to execute arbitrary commands. While this shortcoming was patched by Contec in version 3.4.5, the software has since been found to be vulnerable to four additional defects that could lead to information disclosure and unauthorized access.
Users of CONPROSYS HMI System are recommended to update to version 3.5.0 or later, in addition to taking steps to minimize network exposure and isolate such devices from business networks. The advisories come less than a week after CISA released 12 such alerts warning of critical flaws impacting software from Sewio, InHand Networks, Sauter Controls, and Siemens.
Despite the threats of cyberattack on computer-controlled industrial systems, utilities and other users of these systems can be hesitant to adopt common security technologies out of concern for their impact on system performance. NIST developed a guide to help industry understand and implement cybersecurity approaches to protect them from these threats.
See: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf
NIST Special Publication 800-82 helps industry strengthen the cybersecurity of its computer-controlled systems. These systems are used in industries such as utilities and manufacturing to automate or remotely control product production, handling or distribution. By providing guidance on how to tailor traditional IT security controls to accommodate unique ICS performance, reliability and safety requirements, NIST helps industry reduce the vulnerability of computer-controlled systems to malicious attacks, equipment failures and other threats.[1]
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www. redskyalliance. org/
- Website: https://www. wapacklabs. com/
- LinkedIn: https://www. linkedin. com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5504229295967742989
https://thehackernews.com/2023/01/cisa-warns-of-flaws-in-siemens-ge.html
Comments