CISA Issues Warning: Vulnerability in Deep Sea Electronics DSE855 Exploitable

On October 24, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a critical advisory regarding a vulnerability found in Deep Sea Electronics' DSE855, an Ethernet communications device widely utilized in the energy sector. The vulnerability, identified as CVE-2024-5947, reveals a serious flaw that could expose sensitive credentials stored in the device. Here’s a breakdown of what this means for users, the nature of the threat, and steps to protect against potential exploitation.

Executive Summary​

• CVSS v4 Score: 7.1 (indicating a high severity)
• Vulnerability Type: Missing Authentication for Critical Function (CWE-306)
• Vendor: Deep Sea Electronics
• Hardware Affected: DSE855
• Risk Level: Attention needed due to low complexity in exploiting this vulnerability.

The primary risk stemming from this vulnerability is the potential for an attacker to obtain stored credentials simply by making specific HTTP GET requests to the device’s Backup.bin file. This straightforward approach underscores the necessity for immediate action.

Risk Evaluation​

The successful exploitation of this vulnerability presents a significant risk as it would allow unauthorized access to credentials stored within the DSE855, potentially impacting control systems' integrity. Given that these systems are often crucial to critical infrastructure, this vulnerability is particularly concerning in a world increasingly reliant on interconnected and automated technologies.

Technical Details​

Affected Products​

To understand the scope of the impact, note the specific affected version:

• DSE855: Version 1.0.26

Vulnerability Overview​

The core issue here revolves around how the DSE855 processes authentication for critical operations. Specifically, the device lacks necessary protections against unauthorized access to its communications configuration files. The vulnerability arises due to the retrieval of the Backup.bin file being improperly authorized, therefore, allowing anyone who knows the endpoint to access potentially sensitive information.

• CVE Reference: CVE-2024-5947

CVSS Scoring​

• CVSS v3.1 Score: 6.5
  • Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS v4 Score: 7.1
  • Vector: CVSS4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

This scoring highlights the vulnerability's accessibility (Authentication is not required) and its potential for significant information compromise (Availability is not impacted).

Background Information​

Deep Sea Electronics is a UK-based company providing control and monitoring solutions primarily used in the energy sector. The DSE855 device is deployed globally, making this vulnerability one that could affect numerous facilities worldwide, emphasizing the urgency in addressing this issue.

Recommended Mitigations​

Deep Sea Electronics has issued guidance urging users to update their devices to version 1.2.0 to close this vulnerability effectively. CISA further recommends additional actions:

1. Restrict Network Exposure: Devices should not be directly accessible from the internet. Implementing firewalls to isolate control systems can help mitigate exposure risks.
2. Secure Remote Access: When remote access is necessary, utilize secure protocols, such as Virtual Private Networks (VPNs). Ensure these VPNs are kept up-to-date and secure to reduce vulnerabilities.
3. Conduct Regular Risk Assessments: Organizations should evaluate their cybersecurity posture regularly to identify potential vulnerabilities within their systems and applications.
4. Report Malicious Activities: Organizations must follow established protocols to report any suspected malicious activity to CISA for enhanced intelligence sharing and incident tracking.
5. Consult Best Practices: Leverage CISA’s guidelines on cybersecurity practices, particularly for industrial control systems, to bolster defenses against a variety of threats.

Conclusion​

Organizations utilizing the Deep Sea Electronics DSE855 should take immediate steps to mitigate risks associated with CVE-2024-5947. Ignoring vulnerabilities like these can lead to ripple effects in critical infrastructures that are vital for public safety and operational continuity. For detailed information, users are encouraged to consult the full advisory on the CISA website and ensure their systems remain secure against evolving threats.
By proactively addressing such vulnerabilities and adhering to robust cybersecurity practices, organizations can protect their assets and avoid potential disruptions in their operations.
Source: CISA Deep Sea Electronics DSE855