Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Authentication Bypass Vulnerability Affects 22 Schneider Electric Products

Flaw in Schneider Electric Web HMI Allows Authentication Bypass

The U.S. Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) published an advisory this week to warn organizations of a directory traversal vulnerability affecting several products developed by energy management solutions company Schneider Electric.

Flaw in Schneider Electric Web HMI Allows Authentication Bypass

The U.S. Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) published an advisory this week to warn organizations of a directory traversal vulnerability affecting several products developed by energy management solutions company Schneider Electric.

The vulnerability (CVE-2014-0754) exists in the SchneiderWEB Web human-machine interface (HMI), which is deployed in products used across several sectors, including communications, energy, critical manufacturing, water and wastewater systems. The vulnerability affects the Modicon PLC Ethernet communication modules in a total of 22 products, ICS-CERT noted.

“This vulnerability allows an attacker to bypass the basic authentication on the web server. Using directory traversals an attacker can bypass the basic authentication mechanism in the web server and gain unauthorized access to protected resources. This vulnerability would require network access to the target device through TCP/IP and particularly HTTP,” Schneider Electric said in its own advisory.

 According to ICS-CERT, the flaw can be exploited remotely by an attacker with a low skill level.

RelatedLearn More at the 2014 ICS Cyber Security Conference

The company has released firmware updates for the affected products, but says there is no evidence that the vulnerability has been exploited. Organizations can also protect themselves against potential attacks leveraging this bug by disabling port 80 on modules (when possible), by restricting access to port 80 in firewalls, and by using a deep packet inspection (DPI) firewall to prevent HTTP requests to affected products.

ICS-CERT says the vulnerability has been identified by Billy Rios, an independent security researcher who has often uncovered flaws in ICS and SCADA systems. Schneider Electric noted that the same issue was also uncovered during internal investigations. Rios has confirmed that the updates produced by the company properly address the vulnerability.

It appears several security experts are focusing their efforts on finding flaws in Schneider Electric products these days. An advisory published by ICS-CERT last month revealed the existence of three vulnerabilities in the company’s StruxureWare SCADA Expert ClearSCADA products.

Advertisement. Scroll to continue reading.

In July, Schneider Electric teamed up with Waterfall Security Solutions in an effort to protect its customers’ systems with the aid of Waterfall’s Unidirectional Security Gateway technologies.

 

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.