The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has released a series of advisories detailing security issues identified by researchers in products from XZERES, Honeywell, and Johnson Controls.
According to ICS-CERT, Johnson Controls has released patches to address two high severity vulnerabilities affecting the 4.1, 5.x and 6.x releases of the Metasys building management system. The vulnerable releases are used in products such as Application and Data Server (ADS), Extended Application and Data Server (ADX), LonWorks Control Server 85 (LCS8520), Network Automation Engine (NAE), Network Integration Engine (NIE), and NxE8500.
Security researcher Billy Rios discovered that the Metasys web service is plagued by an unrestricted file upload vulnerability (CVE-2014-5428) that can be exploited by a remote, unauthenticated attacker to upload a shell script to an arbitrary location. The attacker can then execute the malicious script and compromise the affected system, ICS-CERT said.
Rios has also found that passwords are stored in a recoverable format (CVE-2014-5427). A remote attacker can compromise a Metasys system by using an unauthenticated POST request to retrieve the password hash belonging to an authorized user.
Martin Jartelius of Outpost24 has discovered and reported a high severity path traversal vulnerability (CVE-2015-0984) in Honeywell’s XLWeb controllers. The flaw affects several versions of the BACnet Building Controller Excel Web, including XL1000C50, XL1000C100, XL1000C500, XL1000C1000, XL1000C50U, XL1000C100U, XL1000C500U, and XL1000C1000U.
“An attacker may use this vulnerability to generate a valid login for an administrative user on the Honeywell XLWeb controller giving the attacker full administrator access to the system. The XLWEB application effectively becomes an entry point into the network where it is located,” ICS-CERT wrote in an advisory.
ICS-CERT advises organizations to mitigate the flaw by updating their products to Excel Web Linux version 2.04.01 or later, and Computer Aided Regulation Engineering (CARE) software version 10.02 or later.
A vulnerability affecting the XZERES 442SR Wind Turbine have been identified by independent researcher Maxim Rupp. The expert discovered a cross-site request forgery (CSRF) flaw (CVE-2015-0985) in the 442SR operating system.
By launching a CSRF attack against a targeted system, an attacker can change the password of the default user, which has administrative privileges on the system.
According to ICS-CERT, there is no indication that exploits are publicly available for these flaws. However, the vulnerabilities can be exploited remotely even by an attacker with low skill so organizations are advised to apply the updates as soon as possible.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Intel Co-founder, Philanthropist Gordon Moore Dies at 94
- Google Leads $16 Million Investment in Dope.security
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
