CISA Issues Critical ICS Vulnerabilities Advisories: Protect Industrial Systems Now

The Cybersecurity and Infrastructure Security Agency (CISA) has recently issued nine advisories addressing critical vulnerabilities in various Industrial Control Systems (ICS). These advisories highlight potential risks that could significantly impact industrial operations across sectors such as energy, manufacturing, and transportation.

Overview of the Advisories​

The advisories cover a range of products from prominent vendors, including DuraComm, Lantronix, and Schneider Electric. Each advisory provides detailed technical information and recommended mitigations to address the identified vulnerabilities.

Detailed Analysis of Key Vulnerabilities​

DuraComm DP-10iN-100-MU​

Vulnerabilities Identified:

• Cross-Site Scripting (XSS): The product is susceptible to XSS attacks, potentially allowing attackers to prevent legitimate users from accessing the web interface.
• Missing Authentication for Critical Function: Lack of access controls for critical functions could enable unauthorized users to perform actions that should require authentication.

Risk Evaluation:
Successful exploitation could lead to disclosure of sensitive information or denial-of-service conditions.
Mitigation Measures:
Users are advised to update to the latest firmware version and implement strict access controls to mitigate these vulnerabilities.

Lantronix Provisioning Manager​

Vulnerability Identified:

• Improper Restriction of XML External Entity Reference (XXE): The application is vulnerable to XXE attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution.

Risk Evaluation:
Exploitation could allow attackers to execute arbitrary code on hosts with Provisioning Manager installed.
Mitigation Measures:
Lantronix has provided a fix and recommends users update to version 7.10.3 or later.

Schneider Electric EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO)​

Vulnerability Identified:

• Exposure of Resource to Wrong Sphere: A resource exposure vulnerability exists that exposes TGML diagram resources to unauthorized control, allowing other authenticated users unauthorized access.

Risk Evaluation:
This could provide other authenticated users with potentially inappropriate access to TGML diagrams.
Mitigation Measures:
Schneider Electric recommends updating to the latest versions and applying available patches to address this vulnerability.

Schneider Electric System Monitor Application​

Vulnerability Identified:

• Cross-Site Scripting (XSS): In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing certain elements could lead to XSS attacks.

Risk Evaluation:
Successful exploitation could allow an attacker to execute untrusted code.
Mitigation Measures:
Users are advised to update to jQuery version 3.5.0 or later and apply any additional patches provided by Schneider Electric.

Schneider Electric EcoStruxure IT Data Center Expert​

Vulnerabilities Identified:

• OS Command Injection: An improper neutralization of special elements used in an OS command could cause unauthenticated remote code execution when a malicious folder is created via the HTTP web interface.
• Insufficient Entropy: Weak randomness in cryptographic operations could lead to predictable outcomes, compromising security.

Risk Evaluation:
Exploitation could allow an attacker to disrupt operations and access system data.
Mitigation Measures:
Schneider Electric recommends updating to the latest version and implementing network segmentation and firewalls as mitigation strategies.

Implications for Industrial Control Systems​

The vulnerabilities outlined in these advisories underscore the critical importance of maintaining robust cybersecurity measures within ICS environments. Exploitation of such vulnerabilities can lead to unauthorized access, data breaches, and operational disruptions, posing significant risks to critical infrastructure.

Recommendations for ICS Operators​

• Immediate Updates: Apply the latest patches and firmware updates provided by vendors to mitigate identified vulnerabilities.
• Access Controls: Implement strict access controls and authentication mechanisms to prevent unauthorized access to critical functions.
• Network Segmentation: Segment networks to limit the potential impact of a compromised system and prevent lateral movement by attackers.
• Regular Audits: Conduct regular security audits and vulnerability assessments to identify and address potential weaknesses proactively.
• User Training: Educate staff on cybersecurity best practices and the importance of adhering to security protocols.

Conclusion​

The release of these nine ICS advisories by CISA serves as a critical reminder of the evolving threat landscape facing industrial control systems. By promptly addressing these vulnerabilities and implementing recommended security measures, organizations can enhance the resilience of their ICS environments against potential cyber threats.

---

Source: CISA CISA Releases Nine Industrial Control Systems Advisories | CISA