Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Serious Flaws Found in Janitza Power Analyzers

Researchers have uncovered several vulnerabilities in power quality measurement products from Janitza Electronics, a Germany-based company that specializes in the development of energy efficiency systems.

Researchers have uncovered several vulnerabilities in power quality measurement products from Janitza Electronics, a Germany-based company that specializes in the development of energy efficiency systems.

The flaws, found by ICS security firm Applied Risk, affect Janitza’s UMG 508, UMG 509, UMG 511, UMG 512, UMG 604, and UMG 605 power analyzers. According to ICS-CERT, these products are deployed in the energy sector in Europe, the Americas and Asia.

One of the security issues discovered by experts is related to the existence of an undocumented default password that protects an FTP interface and a web service on the affected devices (CVE-2015-3968). An attacker could use the password to log in to the system and upload and download arbitrary files.

Janitza power analyzers are also affected by a flaw that can be exploited through a remote debug interface on TCP Port 1239 to read and write files, and execute JASIC code (CVE-2015-3971). Experts told SecurityWeek that this is a serious vulnerability since the debug interface does not require any authentication and the list of files that can be accessed includes a file that contains the admin password in plain text.

ICS Cyber Security Conference 2015

“By by leveraging the built-in JASIC script language an attacker can adjust system parameters, manipulate measurement values and change the function of the device, compromising availability, integrity and confidentiality of the device itself and dependent systems,” Applied Risk explained in an advisory.

Another authentication-related problem is that the UMG web interface by default is not protected by a password (CVE-2015-3972). Users can set a password, but it can only be a short PIN and there are no mechanisms in place to prevent potential attackers from entering numerous combinations in an effort to guess it.

Researchers also found weak session tokens that can be used to crack the user PIN, an authentication bypass bug, a persistent cross-site scripting (XSS) flaw, and a vulnerability that can be exploited to obtain network session information.

The vulnerabilities have been identified following tests conducted on a UMG 604 Power Analyser running firmware version r4051 build 244. Applied Risk says Janitza confirmed that other products are affected as well, which is most likely due to the use of the same code base.

Advertisement. Scroll to continue reading.

Applied Risk told SecurityWeek that it first reported the issues to Janitza in late March, but the vendor initially had a hostile attitude towards the company. The vendor later became more cooperative, but it then stopped communicating with the security firm. 

ICS-CERT’s advisory describing the vulnerabilities states that the vendor released firmware updates (r4061 build 269) and new documentation to mitigate the issues. However, Applied Risk says not all flaws have been effectively fixed.

“Besides upgrading to the latest firmware version it is recommended to shield the device from any publicly accessible networks by implementing proper network segregation and by filtering the exposed network services using a network firewall. Devices should be managed from a well secured management PC only, whilst not having any active web browser sessions with untrusted web sites,” Applied Risk recommended in its advisory.

Related: Learn more at the ICS Cyber Security Conference

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

ICS/OT

The overall effect of current global geopolitical conditions is that nation states have a greater incentive to target the ICS/OT of critical industries, while...

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

ICS/OT

Wago has patched critical vulnerabilities that can allow hackers to take complete control of its programmable logic controllers (PLCs).

Cybercrime

Energy giants Schneider Electric and Siemens Energy confirm being targeted by the Cl0p ransomware group in the campaign exploiting a MOVEit zero-day.

ICS/OT

Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.

ICS/OT

Municipal Water Authority of Aliquippa in Pennsylvania confirms that hackers took control of a booster station, but says no risk to drinking water or...

ICS/OT

Mandiant's Chief analyst urges critical infrastructure defenders to work on finding and removing traces of Volt Typhoon, a Chinese government-backed hacking team caught in...