A cybersecurity startup has disclosed a couple of unpatched denial-of-service (DoS) vulnerabilities affecting a human-machine interface (HMI) product from Schneider Electric.
CRITIFENCE, a company that specializes in security solutions for industrial control systems (ICS), reported on Tuesday that Eran Goldstein, its CTO and founder, in April discovered two serious flaws in Schneider Electric Magelis HMI panels.
The affected devices allow operators and process engineers to monitor and manage industrial facilities. Users can configure the products with the Vijeo Designer software.
The security holes, dubbed “PanelShock” and tracked as CVE-2016-8367 and CVE-2016-8374, allow attackers to cause the devices to enter a DoS condition by sending specially crafted HTTP requests. According to the security firm, the issues are caused by improper implementation of HTTP request methods and resource consumption management mechanisms.
“The use cases identified demonstrate the ability to generate a freeze condition on the HMI, that can lead to a denial of service due to incomplete error management of HTTP requests in the Web Gate Server,” Schneider Electric said in an advisory. “While under attack via a malicious HTTP request, the HMI may be rendered unable to manage communications due to high resource consumption. This can lead to a loss of communication s with devices such as Programmable Logic Controllers (PLCs), and require reboot of the HMI in order to recover.”
The PanelShock vulnerabilities affect Magelis GTO, GTU, STO, STU and XBT panels. Schneider Electric has yet to release patches, but it has provided recommendations on how to mitigate possible attacks. The energy management giant has classified the flaws as high severity, but pointed out that the attacks described by CRITIFENCE only work if the Web Gate Server, which is disabled by default, is active.
The vendor has informed users of Magelis GTO Advanced Optimum and GTU Universal panels that a new version of the Vijeo Designer software, one that will not include these vulnerabilities, will be released in March 2017.
The flaws can be exploited remotely even by an attacker with low skill and the publicly available information is sufficient for developing an exploit. CRITIFENCE has published a free tool that allows users to check their devices for these types of vulnerabilities and a video that shows how an attack works:
Last week, at SecurityWeek’s 2016 ICS Cyber Security Conference, researchers from Indegy and CyberX reported finding some serious vulnerabilities in Schneider’s Unity Pro software platform and its ConneXium industrial firewalls.
Related: ICS-CERT Issues Alerts After Expert Discloses Power Meter Flaws
Related: U.S. Has Most Internet Connected Industrial Control Systems
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
- Microsoft Adding New Security Features to Windows 11
- Sony Investigating After Hackers Offer to Sell Stolen Data
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
Latest News
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
- Microsoft Adding New Security Features to Windows 11
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
- Sony Investigating After Hackers Offer to Sell Stolen Data
- The CISO Carousel and its Effect on Enterprise Cybersecurity
- Xenomorph Android Banking Trojan Targeting Users in US, Canada
- $200 Million in Cryptocurrency Stolen in Mixin Network Hack
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
