Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Authentication Bypass Vulnerability Affects 22 Schneider Electric Products

Flaw in Schneider Electric Web HMI Allows Authentication Bypass

The U.S. Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) published an advisory this week to warn organizations of a directory traversal vulnerability affecting several products developed by energy management solutions company Schneider Electric.

Flaw in Schneider Electric Web HMI Allows Authentication Bypass

The U.S. Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) published an advisory this week to warn organizations of a directory traversal vulnerability affecting several products developed by energy management solutions company Schneider Electric.

The vulnerability (CVE-2014-0754) exists in the SchneiderWEB Web human-machine interface (HMI), which is deployed in products used across several sectors, including communications, energy, critical manufacturing, water and wastewater systems. The vulnerability affects the Modicon PLC Ethernet communication modules in a total of 22 products, ICS-CERT noted.

“This vulnerability allows an attacker to bypass the basic authentication on the web server. Using directory traversals an attacker can bypass the basic authentication mechanism in the web server and gain unauthorized access to protected resources. This vulnerability would require network access to the target device through TCP/IP and particularly HTTP,” Schneider Electric said in its own advisory.

 According to ICS-CERT, the flaw can be exploited remotely by an attacker with a low skill level.

RelatedLearn More at the 2014 ICS Cyber Security Conference

The company has released firmware updates for the affected products, but says there is no evidence that the vulnerability has been exploited. Organizations can also protect themselves against potential attacks leveraging this bug by disabling port 80 on modules (when possible), by restricting access to port 80 in firewalls, and by using a deep packet inspection (DPI) firewall to prevent HTTP requests to affected products.

ICS-CERT says the vulnerability has been identified by Billy Rios, an independent security researcher who has often uncovered flaws in ICS and SCADA systems. Schneider Electric noted that the same issue was also uncovered during internal investigations. Rios has confirmed that the updates produced by the company properly address the vulnerability.

It appears several security experts are focusing their efforts on finding flaws in Schneider Electric products these days. An advisory published by ICS-CERT last month revealed the existence of three vulnerabilities in the company’s StruxureWare SCADA Expert ClearSCADA products.

In July, Schneider Electric teamed up with Waterfall Security Solutions in an effort to protect its customers’ systems with the aid of Waterfall’s Unidirectional Security Gateway technologies.

 

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.