CISA Alerts on Critical Security Vulnerabilities in Industrial Control Systems

Mar 22, 2023Ravie LakshmananICS/SCADA Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
has released eight Industrial Control Systems (ICS) advisories^[1]
on Tuesday, warning of critical flaws affecting equipment from
Delta Electronics and Rockwell Automation.

This includes 13 security vulnerabilities in Delta Electronics’
InfraSuite Device Master, a real-time device monitoring software.
All versions prior to 1.0.5 are affected by the issues.

“Successful exploitation of these vulnerabilities could allow an
unauthenticated attacker to obtain access to files and credentials,
escalate privileges, and remotely execute arbitrary code,” CISA
said^[2].

Top of the list is CVE-2023-1133^[3]
(CVSS score: 9.8), a critical flaw that arises from the fact that
InfraSuite Device Master accepts unverified UDP packets and
deserializes the content^[4], thereby allowing an
unauthenticated remote attacker to execute arbitrary code.

Two other deserialization flaws, CVE-2023-1139^[5]
(CVSS score: 8.8) and CVE-2023-1145^[6]
(CVSS score: 7.8) could also be weaponized to obtain remote code
execution, CISA cautioned.

Piotr Bazydlo and an anonymous security researcher have been
credited with discovering and reporting the shortcomings to
CISA.

Another set of vulnerabilities relates to Rockwell Automation’s
ThinManager ThinServer and affects the following versions of the
thin client and remote desktop protocol (RDP) server management
software –

• 6.x – 10.x
• 11.0.0 – 11.0.5
• 11.1.0 – 11.1.5
• 11.2.0 – 11.2.6
• 12.0.0 – 12.0.4
• 12.1.0 – 12.1.5, and
• 13.0.0 – 13.0.1

The most severe of the issues are two path traversal flaw
tracked as CVE-2023-28755^[7]
(CVSS score: 9.8) and CVE-2023-28756^[8]
(CVSS score: 7.5) that could permit an unauthenticated remote
attacker to upload arbitrary files to the directory where the
ThinServer.exe is installed.

Even more troublingly, the adversary could weaponize
CVE-2023-28755 to overwrite existing executable files with
trojanized versions, potentially leading to remote code
execution.

“Successful exploitation of these vulnerabilities could allow an
attacker to potentially perform remote code execution on the target
system/device or crash the software,” CISA noted^[10].

Users are advised to update to versions 11.0.6, 11.1.6, 11.2.7,
12.0.5, 12.1.6, and 13.0.2 to mitigate potential threats.
ThinManager ThinServer versions 6.x – 10.x are retired, requiring
that users upgrade to a supported version.

As workarounds, it is also recommended that remote access of
port 2031/TCP is limited to known thin clients and ThinManager
servers.

The disclosure arrives more than six months after CISA alerted^[11] of a high-severity
buffer overflow vulnerability in Rockwell Automation ThinManager
ThinServer (CVE-2022-38742^[12], CVSS score: 8.1) that
could result in arbitrary remote code execution.