Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Schneider Electric Patches Flaw in Motion USA Website

Energy management giant Schneider Electric has patched a cross-site scripting (XSS) vulnerability on one of its websites.

Energy management giant Schneider Electric has patched a cross-site scripting (XSS) vulnerability on one of its websites.

Elastica researcher Aditya Sood, who recently disclosed the existence of vulnerabilities in the Supervisory Control and Data Acquisition (SCADA) products of several major vendors, reported identifying a reflected XSS flaw on Schneider Electric’s e-order.biz website.

E-order.biz is a site where users can order products from Schneider Electric Motion USA, a Schneider Electric subsidiary that designs, manufactures and supplies motors, drives, and controls used in areas such as robotics, medical instruments, semiconductor manufacturing, laboratory automation, packaging, and biomedical.

An advisory provided by Sood to SecurityWeek shows that the developers of the e-order website failed to sanitize the input passed by remote users in an HTTP request, allowing an attacker to execute arbitrary JavaScript code in the context of the web application.

According to the researcher, an attacker could have executed JavaScript code designed to steal cookies and session identifiers in an effort to hijack accounts. Malicious actors could have also leveraged the XSS vulnerability to take users to phishing sites or display phishing pages in an iframe within the legitimate website.

Schneider Electric Motion USA XSS 

Sood noted that an attacker could have also forced users to download malicious code onto their computers.

Schneider Electric patched the XSS vulnerability on e-order.biz within a few weeks after it was reported by Sood. The company told the researcher that it has taken this opportunity to bring third-party service providers up to speed on secure development practices.

While this particular issue affected one of Schneider Electric’s websites, the company’s industrial control system (ICS) products are also often found to be plagued by vulnerabilities. A report released in September by threat intelligence firm Recorded Future showed that roughly 20 flaws affecting Schneider ICS products have been disclosed annually since 2011.

Advertisement. Scroll to continue reading.

The Recorded Future report shows that Schneider and Siemens are the companies with the highest number of vulnerabilities disclosed each year, which is not surprising given the popularity of their products.

Schneider Electric is one of the ICS vendors whose products were analyzed earlier this year by Sood. Since the vulnerabilities were previously reported by a different researcher, Schneider managed to develop a patch within a month after Sood disclosed his findings at the DEF CON conference in Las Vegas.

Related: Learn More at the ICS Cyber Security Conference

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

ICS/OT

The overall effect of current global geopolitical conditions is that nation states have a greater incentive to target the ICS/OT of critical industries, while...

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

ICS/OT

Wago has patched critical vulnerabilities that can allow hackers to take complete control of its programmable logic controllers (PLCs).

Cybercrime

Energy giants Schneider Electric and Siemens Energy confirm being targeted by the Cl0p ransomware group in the campaign exploiting a MOVEit zero-day.

ICS/OT

Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.

ICS/OT

Municipal Water Authority of Aliquippa in Pennsylvania confirms that hackers took control of a booster station, but says no risk to drinking water or...

ICS/OT

Mandiant's Chief analyst urges critical infrastructure defenders to work on finding and removing traces of Volt Typhoon, a Chinese government-backed hacking team caught in...